--- linux-2.6.17-rc3-mm1-davej/arch/i386/mm/pageattr.c.org 2006-05-04 09:23:56.000000000 +0200 +++ linux-2.6.17-rc3-mm1-davej/arch/i386/mm/pageattr.c 2006-05-04 09:27:21.000000000 +0200 @@ -9,6 +9,7 @@ #include <linux/highmem.h> #include <linux/module.h> #include <linux/slab.h> +#include <linux/kernel.h> #include <asm/uaccess.h> #include <asm/processor.h> #include <asm/tlbflush.h> @@ -18,6 +19,7 @@ static DEFINE_SPINLOCK(cpa_lock); static struct list_head df_list = LIST_HEAD_INIT(df_list); +extern char __start_rodata, __end_rodata; pte_t *lookup_address(unsigned long address) { @@ -127,10 +129,16 @@ pte_t *kpte; unsigned long address; struct page *kpte_page; + static int once = 0; BUG_ON(PageHighMem(page)); address = (unsigned long)page_address(page); + if (address >= __start_rodata && address <= __end_rodata && prot != __PAGE_KERNEL_RO && once++ == 0) { + printk(KERN_ERR "Possible trojan or rootkit detected!\n"); + add_taint(TAINT_MACHINE_CHECK); + } + kpte = lookup_address(address); if (!kpte) return -EINVAL;