alt Hacker News> They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently)
Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.
> the service ran as root, it UPDATED ITS OWN BINARIES as root!
Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
Replies
darkwi11ow • yesterday at 9:55 PM
I think gp meant DKMS (https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support). It allows for things like using same proprietary device drivers across many Linux kernels.
Sorry DKMS. nvidia distributes closed source .o files and most distributes have dkms packages to build those for each kernel.
> Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
On any Linux distribution, which managed packages update themselves? zero. Crowdstrike should provide package repositories so admins can pull in updates at their regular cadence.
At a minimum, the package should NEVER update its own binaries located in /usr/bin or /opt. If it need to pull updates, those should go in /var. Crowdstrike could have made the core binaries a shim where they load a second stage from /var.