• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

OS2-eCS kernel

Started by melf, 2008.01.11, 11:46:16

Previous topic - Next topic

melf

Just a question out of curiousity. By coincident I read in an article that some security researcher demonstrated how to bypass Vista kernel protection. And she said that "we don't believe it's possible to implement effective kernel protection on any general purpose OS based on monolithic kernel design." She also said that microkernels were her favourite technics according to kernel security. So how about the OS2-eCS kernel isn't it some hybride? Is it easier to protect? Well,please note that I don't understand the technicallities at all, but I just saw a niche for our beloved OS eventually. Here is a link to the cited statement: http://theinvisiblethings.blogspot.com/2007/08/virtualization-detection-vs-blue-pill.html
/Mikael

RobertM

Melf,

If memory serves you are indeed correct. The Intel based OS/2 kernel is kind of hybrid (while the PPC kernel is supposedly a true microkernel). One other big difference that may (or may not) affect such issues is that OS/2 uses the CPU protection levels differently than any variant of Windows (including using one in particular that Windows doesnt use - Ring 2 I *think*).

Not sure if this has to do with the method in which the various Ring 0 components are used and/or locked, but under OS/2 various ones cannot be changed while the OS is running - but the fact that they CAN be changed (including the kernel) by various fixpack installers would indicate they aren't as protected as they can or should be. In this area, Vista (and possibly even XP) have somewhat better protection (even if broken) since there is some level of protection there to prevent/protect the kernel from changes... so, on Vista, one would have to escalate the priviledges of an app to modify or change the kernel.

I can't 100% recall what I did to upgrade the kernels in my system - but I think it required booting off a Warp CD and replacing it - if that is the only method, then I am pretty sure that is because the kernel becomes locked during the early boot stages. The only way around that I can think of would be to replace (some of the components of) the OS2LOADR to boot the replacement kernel and then leave it like that - or replace the original (kernel) and restore the OS2LOADR.

AFAIK, there really isn't any way of protecting any kernel - not without full, working protection on other things like the MBR (would be simple to use a method similar to GRUB Stage 1 to load code from a user area of the disk to replace a kernel that hasn't yet been used). That's a big problem in the current method, since the MBR doesnt do much other than point to what the machine should boot - and if it's a code section in the user area of the drive, there isn't much that can be done to protect the kernel.

-Robert


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


melf

Thank for your answer Robert. Even if I don't understand everything so at least I'm back to earth again ,reminded of that nothing is one way or the other or black and white.
/Mikael