6 ms·
It runs at Ring 0, there's no lower ring (besides maybe IME and the like).
by lnx01 2y ago
It runs at Ring 0, there's no lower ring (besides maybe IME and the like).
- BLKNSLVR 2y agoThe problem I have with this is that anti-virus software has never felt like the most reliable, well-written, trustworthy software that's deserving of it's place in Ring 0. I understand I'm yelling into the storm here, because anti-virus also requires that level of system access due to the nature of what it's trying to detect. But then again, does it only need Ring 0 access for the worst of the worst? Can it run 99% of the time in Ring 1, or user space, and only instantiate it's Ring 0 privileges for regular but infrequent scans or if it detects something else may be 'off'? Default Ring 0? Earn it. This turns into a "what's your threat level" discussion.
- yjftsjthsd-h 2y agoTechnically, there are rings -1 through -3; hypervisor/-1 actually seems widely used and maybe could be used here. https://en.wikipedia.org/wiki/Protection_ring#Miscellaneous https://en.wikipedia.org/wiki/Protection_ring#Miscellaneous