On 2026-09-07 5:20 AM, Florian Weimer wrote:
It's very narrow if this only detects on very specific form of run-time patching.
So, yes, got-audit only checks for function hijacking via GOT tampering. But we can add new tools to look for other types of run-time patching. It looks like this example would be easy to detect. We'd just need to find out if any of this exists in non-CSB environments (i.e. Fedora CI), and figure out how to allow-list anything we're aware of that's legitimate and expected in that environment.
This is interesting. I'll start work on it. -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
