If I'm a malicious actor that gets root, can I killswitch the killswitch?
Once you’ve got root, you don’t need to exploit compromised code to do whatever you want.
LSMs say otherwise
Killswitch: Per-function short-circuit mitigation primitive
21–25 of 25 posts
Re: Killswitch: Per-function short-circuit mitigation primitive
#22Could something like this also be done via BPF?
That’s how this[0] project mitigates e.g. CopyFail.
BPF LSM if you want to return -EPERM.
Or a kprobe that kills the process via bpf_send_signal() if BPF LSM isn’t enabled.
[0] https://github.com/cozystack/copy-fail-blocker#how-it-works