Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #39307

Re: "Linux kernel security needs a rethink" ?

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Mike Easter wrote:
> Melzzzzz wrote:
>>> Yrrah wrote:
>>>> And now explained to the unitiated? ;-)
>>>
>>> Drivers in the kernel is a HUGE problem.
>>
>> What does this means?
>
> Dangerous LKM modules.
>
> Even with all of the loadable modules unloaded, the monolithic kernel is 
> 'vast', not really resembling anything like a 'self-healing' micro or 
> nano kernel used for some secure purposes.
>
> The DoD sez; "The TCB shall [implement] complete, conceptually simple 
> protection mechanisms with precisely defined semantics. [...]
> ... where TCB = trusted computing base which of course includes/is the 
> kernel and whatever danger is hidden inside.

(Hopefully I get the quoting right)

This is all well and good, but also kind of relies on using known
hardware / being able to compile for one specific CPU / SoC.  Out here
in the real world (i.e. general business), we don't have that luxury,
and, in the most part "have to" use the generic kernels.

Sure, there's nothing stopping one from compiling the kernel for their
specific server ... but that would fall over as soon as you needed to
change / upgrade the hardware (e.g. replace a faulty NIC).

What I think we'll start seeing, at least for this type of "secured
computing" in the general populace is probably something more along the
lines of a hardened hypervisor OS (e.g. it'll only run on [insert mfg
here] blades, and incorporates these TCB ideals), but then presents
"generic" hardware that a "less secure" / generic kernel can deal with,
for the sake of usability / simplicity[*].


* In other words, so "Dave" in Bangalore can support it, after Steve in
  Texas has been "downsized" because 
  | "fuck you, we can get 15 people from this outsourcing company for your
  |  salary."
  |        - Beancounters 
  

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX66E+AAoJEI4R3fMSeaKBahAH/ROVlJh+0TB79RtOdofgK9EU
xbNvqokCiu+87YmU4A7uVaGbJcL7g1XPhK2pdhE6pZwMM/CLRVzZgw2Q4Y2dVQnR
vTU/gtCyI34y4/0cnt2xn2uIXeWWNV6eZbmoMjc/5dEBys2wwBQ6rCMVKWiBpTyx
4wZoHjxTYCcE4jV/F9MlzDTxQhkTK/U7d6LZt7HWTLuQgOH8hZRQP0FKpkAIznhD
h75+eBn863Y4g76jtg7OxFo0buRwXS0nAl14HLXPfaTk71JNt7yaNjkXsnJfKCUh
vb24Au/iZlYUyMR3BPp5q51p2wWl37579k12rjDQPwD9K5j1Uln0Ga4RdRQoeWc=
=FHVG
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

Back to alt.os.linux | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

"Linux kernel security needs a rethink" ? Yrrah <Yrrah-aol@aol.invalid> - 2016-09-27 16:28 +0200
  Re: "Linux kernel security needs a rethink" ? jrg <connyank@cox.net> - 2016-09-27 08:25 -0700
  Re: "Linux kernel security needs a rethink" ? Mike Easter <MikeE@ster.invalid> - 2016-09-27 08:43 -0700
    Re: "Linux kernel security needs a rethink" ? Melzzzzz <Melzzzzz@zzzzz.com> - 2016-09-27 15:51 +0000
      Re: "Linux kernel security needs a rethink" ? Mike Easter <MikeE@ster.invalid> - 2016-09-27 09:03 -0700
        Re: "Linux kernel security needs a rethink" ? "J.O. Aho" <user@example.net> - 2016-09-27 18:26 +0200
        Re: "Linux kernel security needs a rethink" ? Mike Easter <MikeE@ster.invalid> - 2016-09-27 09:35 -0700
          Re: "Linux kernel security needs a rethink" ? Melzzzzz <Melzzzzz@zzzzz.com> - 2016-09-27 16:43 +0000
            Re: "Linux kernel security needs a rethink" ? Bud Frede <frede@mouse-potato.com> - 2016-09-28 06:59 -0400
        Re: "Linux kernel security needs a rethink" ? Melzzzzz <Melzzzzz@zzzzz.com> - 2016-09-27 16:42 +0000
          Re: "Linux kernel security needs a rethink" ? Peter Köhlmann <peter-koehlmann@t-online.de> - 2016-09-27 18:53 +0200
            Re: "Linux kernel security needs a rethink" ? stepore <linshine@here.now> - 2016-09-27 21:07 -0700
              Re: "Linux kernel security needs a rethink" ? Bud Frede <frede@mouse-potato.com> - 2016-09-28 07:36 -0400
            Re: "Linux kernel security needs a rethink" ? William Unruh <unruh@invalid.ca> - 2016-09-28 10:28 +0000
        Re: "Linux kernel security needs a rethink" ? Dan Purgert <dan@djph.net> - 2016-09-28 10:55 +0000
    Re: "Linux kernel security needs a rethink" ? Mike Easter <MikeE@ster.invalid> - 2016-09-27 08:53 -0700
      Re: "Linux kernel security needs a rethink" ? Chris Ahlstrom <OFeem1987@teleworm.us> - 2016-09-27 12:39 -0400
    Re: "Linux kernel security needs a rethink" ? Bud Frede <frede@mouse-potato.com> - 2016-09-28 06:56 -0400

csiph-web