Linux Rootkits: New Methods for Kernel 5.7+

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

What’s Going On? Back in February 2020, there were some stirrings on the LKML about unexporting kallsyms_lookup_name() from the kernel. The main reason for this is that unscrupulous module developers will often simply add MODULE_LICENSE('GPL') to their code (without actually licensing their module as such). Then, using kallsyms_lookup_name(), they can use any other exported kernel function…

Read on /posts/linux_rootkits_11/ ↗