Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

blog.theori.io

8 pointstodsacerdoti3 comments

Does anyone know why modprobe_path isn't in read only memory? Would just making it const char be enough to avoid this technique?

Oh, it's because it can be set by /proc/sys/kernel/modprobe

There is CONFIG_STATIC_USERMODEHELPER that disables the sysctl you mentioned and actually make modprobe_path read-only.