another kconfig target for building monolithic kernel (for security) ?

[devzero@web.de]

Hello !

i want to harden a linux system (dedicated root server on the internet) by recompiling the kernel without support for lkm (to prevent installation of lkm based rootkits etc)

since the "minimalistic" approach (removing complexity) is always a good strategy for security , it seems that it generally isn`t a trivial task to "strip down" the running kernel with xconfig/menuconfig, i.e. to turn the running kernel into an minimalistic monolithic version which "just fits" to the current hardware and contains the absolutely necessary. 

especially when you have no physical access to the machine, there is some danger that the system doesn`t boot and needs some operator resetting it and boot into working configuration again.

what i assume what could be needed is something like a build-target "make hardened-config-based-on-running-kernel" which does the following

- look at the running kernel which components/modules are loaded/used/active
- make  a .config based on that information (i.e. remove all unneded and turn this into monolithic version)
- probably tell the user what will be disabled in the monolitic kernel 

if this doesn`t sound too dumb (comments?) - maybe there is some sort of "receipe" or project how to do this in a more comfortable way (i.e. without working through the whole .config and without in-depth knowledge of all .config params) ?

regards
roland k.
systems engineer




_______________________________________________________________
SMS schreiben mit WEB.DE FreeMail - einfach, schnell und
kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/