Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!cornell!uw-beaver!rice!sun-spots-request
From: weaverj@eecae.ee.msu.edu (Jeff Weaver)
Newsgroups: comp.sys.sun
Subject: L1-a
Keywords: SunOS
Message-ID: <8904132313.AA29605@eecae.ee.msu.edu>
Date: 26 Apr 89 07:00:48 GMT
Sender: usenet@rice.edu
Organization: Sun-Spots
Lines: 29
Approved: Sun-Spots@rice.edu
Original-Date: Thu, 13 Apr 89 19:13:35 EDT
X-Sun-Spots-Digest: Volume 7, Issue 254, message 5 of 12

In a previous posting, someone (I'm not sure who) noted a way to disable
L1-a by just returning from the 'montrap' routine.  I have a different way
that diables the jump into monitor from the kbdinput() routine.  This seems
to disable other keyboard jumps into the monitor from programs such as
kadb.  It's very important to disallow L1-a because a
person with knowledge of UNIX internal's can abort a running system,
change kernel accreditation structeres, and then *continue* UNIX.

The fix (SunOs 3.5, but I expect it is simmilar for others) is to change
the instruction at 'kbdinput+0x21e' to a NOP.

% adb -k -w /vmunix /dev/mem
(system vm map info printed out, etc)
kbdinput+0x21e/w 0x4e71   (for running kernel)
kbdinput+0x21e?w 0x4e71   (for kernel image)
montrap/w 0x4e75
montrap?w 0x4e75
$q

Watchdog Reset is still serviceable, but with proper security on UNIX re-entry,
this can be minimized (as the continuation of UNIX from a watchdog reset is
difficult at best).

jeff

Jeffrey Weaver, System Programmer, ERDL       Phone: (517) 355-3769
260 Engineering Bldg.
Michigan State University
weaverj@eecae.ee.msu.edu               ...uunet!frith!eecae!weaverj