6 ms·
Except for example when the user needs to either do something only doable in kernel space or to diagnose and analyze kernel behavior. I would have loved an opt
by vardump 7y ago
Except for example when the user needs to either do something only doable in kernel space or to diagnose and analyze kernel behavior.
I would have loved an option like this for example when working with a power management issue last time (PCI-e surprise removal and hot-plug can be annoying!)... Sure, I can use remote kernel debuggers etc., but those can be sometimes a hassle to set up, not always the most convenient option.
Like when an issue occurs on the other side of the world, and kernel dumps and tracing leads nowhere. Having an extra option for easy injection of code in kernel would be a nice thing to have in the toolbox.
In other words, one-off scenarios. It wouldn't be something you'd release for wider use.
Knee-jerk reactions have been somewhat off-putting lately. All of us should keep in mind other people might have a completely different mindset, problems and needs than our own. We should celebrate new ideas and novel points of view and not to brainlessly use existing dogma or cheap talking points to immediately slam them.
(I've developed (among other things) commercial kernel drivers for Windows. And "for fun" for Linux just to keep my skills updated.)
- rwmj 7y agoThat's just a side effect of the way Linux puts everything into a giant trusted binary. The GP is correct that we should separate out services (probably to separate sockets until Spectre-like attacks are fixed), even if it's also true that when dealing with Linux-as-it-is-today the solution to everything being in the kernel is to put more stuff in the kernel.
- aey 7y agoAny sandboxing adds a performance overhead. There is no free lunch in Operating Systems.
- pjmlp 7y agoA tiny performance overhead is worthwhile in name of security. For example, I don't remember the last time I cared about disabling bounds checking, even in C++ code (VC++ allows to keep it on).
- rurban 7y agoTell that the various libc maintainers. They are blocking the C11 Annex K (safe bounds checks) for over a decade now. And talking about performance With good compilers my secure memcpy_s is actually faster than the glibc or BSD libc memcpy, with compile-time constexpr.
- pjmlp 7y agoI would blame ISO C, by making Annex K optional, and not caring to improve C's safety in general.
- aey 7y agoI am quite happy with rust these days. But it still lacks great ‘no allocation’ libraries.
- rurban 7y agoThen you are illusional. None of their safety guarantees are real. Memory, type, concurrency, none. But talking to them fall on deaf ears. Its called hype driven development and very popular amongst HN folks. There exist plenty of real safe languages though.
- monocasa 7y agoThe whole point of BPF is that you can't run this code in a separate context _and_ have the code work. The original use case was packet filtering in interrupts because waiting for user space took too long.
- vardump 7y ago> The GP is correct that we should separate out services... That's why I said "It wouldn't be something you'd release for wider use.". I wanted to point out there are use cases where a full-fledged kernel module would be an overkill, and some safety would be desirable. Not safety and security from others, but from myself, so that small dumb mistakes are less likely to cause kernel crashes. For research, debugging, curiosity, and so on. Not necessarily for production use! Although, now that I think about it, it would be nice to be able to sandbox trusted code as a part of a kernel module as well. Writing kernel code is hard work, because it needs to be truly correct. There's often code in kernel drivers that's not performance critical, but must be done in kernel mode and must be crash-free and secure to execute. So why not take advantage of sandboxing for additional safety?
- pjmlp 7y agoThat is what Windows 10 introduced with its secure kernel hypervisor. https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://docs.microsoft.com/en-us/windows-hardware/design/dev...
- AstralStorm 7y agoWhat would this sandboxing achieve? If you mean kernel internally using multiple protection rings, tricky to do in Linux, because the API in that either has to be tight or it's still not too secure. E.g. if you just take RCU or softirqd into near userspace, as done in RT patchset, but then introduce context switching overhead, life is going to be relatively ok, but you've covered only relatively small parts of the drivers. And RT breaks drivers without even introducing more overhead. It would take a major overhaul.