Hacker News Reader

No, this is very much Linux-only.

But in theory could something similar have been developed for OpenBSD?

There is even a book about designing FreeBSD rootkits: http://www.amazon.com/Designing-BSD-Rootkits-Introduction-Ha...

OpenBSD does not have loadable kernel modules, so the techniques described for FreeBSD most likely do not apply.

As for the Azazel rootkit, it uses LD_PRELOAD. According to the ld.so manpage[1] it is ignored for setuid/setgid executables. This looks like the behaviour is not exactly that of the Linux ld.so so perhaps this limits the rootkit's impact.

[1] http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&section=1

openbsd does have loadable kernel modules

http://www.openbsd.org/cgi-bin/man.cgi?query=lkm

LD_PRELOAD and friends are also ignored on linux for setuid/setgid binaries, otherwise privilege escalation would be trivial, just start any dynamicly linked setuid binary with LD_PRELOAD and go to town.

OpenBSD's kernel modules are for development only. They require a securelevel change and a reboot to enable.

In theory, something similar can be developed for any operating system IMHO, OpenBSD or otherwise. What varies is the amount of technical difficulty involved.

Reply on news.ycombinator.com