11 ms·

Lua in the Kernel?

116 points by signa11 6y ago

donatj 6y ago
Smells like an attack vector waiting to happen to me. Malformed network request, sandbox escape, front page of Hacker News like 8-10 years from now? I am often irrationally paranoid about this sort of thing however.
- DarkWiiPlayer 6y ago
  The neat thing about Lua is: It's simple. It's reasonable to expect that a sandbox can be proven to be inescapable considering there's only a very limited set of features that would allow this sort of thing in the first place (mainly the `debug` library, which I doubt will be exposed)
pmarin 6y ago
NetBSD supports Lua in the kernel since 2012. https://www.netbsd.org/gallery/presentations/mbalmer/fosdem2012/kernel_mode_lua.pdf https://www.netbsd.org/gallery/presentations/mbalmer/fosdem2...
- sanxiyn 6y ago
  It's in fact exactly the same thing, since NetBSD Lua started as a port of Lunatik, which is the topic of this article.
moonchild 6y ago
Freebsd has used lua in its bootloader for a few years now. https://wiki.freebsd.org/SummerOfCode2014/LuaLoader https://wiki.freebsd.org/SummerOfCode2014/LuaLoader https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068464.html https://lists.freebsd.org/pipermail/freebsd-current/2018-Feb...
- d33 6y ago
  Wow, it actually sounds like a very elegant idea. I always viewed GRUB as overly complex and rather unpleasant to configure. I wonder why they hadn't gone this way.
  - fsfod 6y ago
    Grub also has an optional module run to Lua code https://git.savannah.nongnu.org/cgit/grub-extras.git/tree/lua https://git.savannah.nongnu.org/cgit/grub-extras.git/tree/lu...
  - kevans91 6y ago
    Note that we haven't yet introduced .lua configuration capabilities (that's a project branch off to the side), but it does certainly make modifying menu entries and other fun stuff a lot more palatable in my experience.
pansa2 6y ago
> Scripts should not be able to crash the system, run indefinitely, or corrupt other parts of the system. To ensure that, Lunatik uses the Lua VM facilities for sandboxing the scripts so that they run in a safe execution environment [...] the number of instructions can be limited, so that infinite loops are not possible. Lua's sandbox should be able to prevent scripts from crashing or corrupting the system, but I'd be surprised if it could prevent a script from running indefinitely. In particular, limiting the number of Lua bytecode instructions is insufficient - even a single call to `string.find` can lock up the CPU [0]. > They are using the standard Lua, rather than the LuaJIT fork, Neto said, in answer to another question. Using LuaJIT would make sandboxing significantly more difficult, because it's much more complex than regular Lua and hence more likely to have exploitable bugs. This is the reason that game consoles disallow JIT-compilation - and hence games tend to use regular Lua rather than LuaJIT. [0] http://lua-users.org/lists/lua-l/2011-02/msg01595.html http://lua-users.org/lists/lua-l/2011-02/msg01595.html
- brmgb 6y ago
  > In particular, limiting the number of Lua bytecode instructions is insufficient - even a single call to `string.find` can lock up the CPU [0]. At first glance, the second part of this sentence doesn't seem to support the initial premise. I am not too familiar with Lua bytecode but wouldn't "string.find" actually be compiled to multiple bytecode instructions ? Unless a single bytecode instruction can lock up the cpu, doing so would most likely require either looping or recursive calls. Thus, by puting a hard limit on the number of instructions the sandbox can execute, it would end up aborting.
  - lmm 6y ago
    > I am not too familiar with Lua bytecode but wouldn't "string.find" actually be compiled to multiple bytecode instructions ? It's probably a single opcode of "invoke native-code standard-library function/intrinsic".
    - pansa2 6y ago
      Yes. `string.find` is implemented in C. Invoking it (no matter how complex its arguments) requires just a few bytecode instructions.
pansa2 6y ago
> Investigation of a "typed Lua" for compilation is something on the roadmap. That is the approach that the main Lua project is taking to compete with LuaJIT on performance. I haven't heard anything about an official "typed Lua". Is there information about it somewhere?
- Benjamin_Dobell 6y ago
  Shameless self promotion: https://github.com/Benjamin-Dobell/IntelliJ-Luanalysis https://github.com/Benjamin-Dobell/IntelliJ-Luanalysis
- soapdog 6y ago
  * Typed Lua: https://github.com/andremm/typedlua https://github.com/andremm/typedlua (not actively maintained) * tl: https://github.com/teal-language/tl https://github.com/teal-language/tl a compiler for Teal a typed dialect of lua. (actively maintained)
  - cassepipe 6y ago
    There is also Luau and Ravi but I don't think any of them is official which was the original question
  - darek 6y ago
    Indeed, Teal looks like it has the right brains behind it (author was involved with several earlier attempts at typed Lua) and is actively maintained. I'm personally watching it for future game development usage.
- deleted 6y ago
  [deleted]
- vnogueira 6y ago
  I believe he was talking about Pallene, which is being currently developed in LabLua Paper: http://www.inf.puc-rio.br/~roberto/docs/pallene-sblp.pdf http://www.inf.puc-rio.br/~roberto/docs/pallene-sblp.pdf Git Repo: https://github.com/pallene-lang/pallene https://github.com/pallene-lang/pallene
7373737373 6y ago
It's only a matter of time until we have metered WebAssembly in the kernel :)
- moring 6y ago
  Actually, why not? The main reason that "in the kernel" is concerning is because untrusted code needs some kind of sandboxing, either by static analysis or by run-time checks. (Most modern systems do a combination of both). After all, the whole "in the kernel" vs. "in userland" distinction only exists because we get hardware-accelerated sandboxing from the CPU and OS combined.
  - 7373737373 6y ago
    Yeah, my comment is actually unironic :) There are a few ways to limit the execution time of wasm programs: - inject code after a set of instructions with a certain duration and in each loop that calls an external function which meters and destroys/suspends execution when a limit is reached (e.g. https://github.com/ewasm/wasm-metering https://github.com/ewasm/wasm-metering) - use a VM which counts instructions (e.g. https://github.com/perlin-network/life https://github.com/perlin-network/life) - use hardware interrupts More random thoughts: https://esolangs.org/wiki/RarVM https://esolangs.org/wiki/RarVM
- m4r35n357 6y ago
  We all know the Linux kernel needs a more "engaging" UX . . .
- htfy96 6y ago
  I guess running an alternative language in kernel is not very challenging. (I tried it two years ago and managed to run i8042 keyboard driver in WebAssembly on Qemu) The hard part is interoperability. Even in languages with automatic C header -> native prototypes conversion capabilities, many kernel features are still not properly handled, especially the macros. Status quo requires the user to manually extract wrappers which could be super tedious.
ivzhh 6y ago
ZFS compiles a modified version Lua 5.2 into zfs.ko and loaded into Linux kernel.
- magicalhippo 6y ago
  To expand slightly, it's used for "channel programs", scripts that can interact with ZFS to create or modify datasets and similar tasks. There's a write-up here[1] about the feature. Main advantage is that it allows for multiple operations to be applied atomically, as well as better error handling. [1]: https://www.delphix.com/blog/delphix-engineering/zfs-channel-programs https://www.delphix.com/blog/delphix-engineering/zfs-channel...
gnufx 6y ago
What happened to the implementation of a Scheme interpreter in Linux from quite a while back? I can't immediately find a reference, and don't remember details. I vaguely remember there was something similar for SunOS too (in the '90s?).

116 points by signa11 6y ago

Smells like an attack vector waiting to happen to me. Malformed network request, sandbox escape, front page of Hacker News like 8-10 years from now? I am often irrationally paranoid about this sort of thing however.

DarkWiiPlayer 6y ago
The neat thing about Lua is: It's simple. It's reasonable to expect that a sandbox can be proven to be inescapable considering there's only a very limited set of features that would allow this sort of thing in the first place (mainly the `debug` library, which I doubt will be exposed)

pmarin 6y ago

NetBSD supports Lua in the kernel since 2012. https://www.netbsd.org/gallery/presentations/mbalmer/fosdem2012/kernel_mode_lua.pdf https://www.netbsd.org/gallery/presentations/mbalmer/fosdem2...

sanxiyn 6y ago
It's in fact exactly the same thing, since NetBSD Lua started as a port of Lunatik, which is the topic of this article.

moonchild 6y ago

Freebsd has used lua in its bootloader for a few years now. https://wiki.freebsd.org/SummerOfCode2014/LuaLoader https://wiki.freebsd.org/SummerOfCode2014/LuaLoader https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068464.html https://lists.freebsd.org/pipermail/freebsd-current/2018-Feb...

d33 6y ago
Wow, it actually sounds like a very elegant idea. I always viewed GRUB as overly complex and rather unpleasant to configure. I wonder why they hadn't gone this way.
- fsfod 6y ago
  Grub also has an optional module run to Lua code https://git.savannah.nongnu.org/cgit/grub-extras.git/tree/lua https://git.savannah.nongnu.org/cgit/grub-extras.git/tree/lu...
- kevans91 6y ago
  Note that we haven't yet introduced .lua configuration capabilities (that's a project branch off to the side), but it does certainly make modifying menu entries and other fun stuff a lot more palatable in my experience.

pansa2 6y ago

> Scripts should not be able to crash the system, run indefinitely, or corrupt other parts of the system. To ensure that, Lunatik uses the Lua VM facilities for sandboxing the scripts so that they run in a safe execution environment [...] the number of instructions can be limited, so that infinite loops are not possible. Lua's sandbox should be able to prevent scripts from crashing or corrupting the system, but I'd be surprised if it could prevent a script from running indefinitely. In particular, limiting the number of Lua bytecode instructions is insufficient - even a single call to `string.find` can lock up the CPU [0]. > They are using the standard Lua, rather than the LuaJIT fork, Neto said, in answer to another question. Using LuaJIT would make sandboxing significantly more difficult, because it's much more complex than regular Lua and hence more likely to have exploitable bugs. This is the reason that game consoles disallow JIT-compilation - and hence games tend to use regular Lua rather than LuaJIT. [0] http://lua-users.org/lists/lua-l/2011-02/msg01595.html http://lua-users.org/lists/lua-l/2011-02/msg01595.html

brmgb 6y ago
> In particular, limiting the number of Lua bytecode instructions is insufficient - even a single call to `string.find` can lock up the CPU [0]. At first glance, the second part of this sentence doesn't seem to support the initial premise. I am not too familiar with Lua bytecode but wouldn't "string.find" actually be compiled to multiple bytecode instructions ? Unless a single bytecode instruction can lock up the cpu, doing so would most likely require either looping or recursive calls. Thus, by puting a hard limit on the number of instructions the sandbox can execute, it would end up aborting.
- lmm 6y ago
  > I am not too familiar with Lua bytecode but wouldn't "string.find" actually be compiled to multiple bytecode instructions ? It's probably a single opcode of "invoke native-code standard-library function/intrinsic".
  - pansa2 6y ago
    Yes. `string.find` is implemented in C. Invoking it (no matter how complex its arguments) requires just a few bytecode instructions.

pansa2 6y ago

> Investigation of a "typed Lua" for compilation is something on the roadmap. That is the approach that the main Lua project is taking to compete with LuaJIT on performance. I haven't heard anything about an official "typed Lua". Is there information about it somewhere?

Benjamin_Dobell 6y ago
Shameless self promotion: https://github.com/Benjamin-Dobell/IntelliJ-Luanalysis https://github.com/Benjamin-Dobell/IntelliJ-Luanalysis
soapdog 6y ago
* Typed Lua: https://github.com/andremm/typedlua https://github.com/andremm/typedlua (not actively maintained) * tl: https://github.com/teal-language/tl https://github.com/teal-language/tl a compiler for Teal a typed dialect of lua. (actively maintained)
- cassepipe 6y ago
  There is also Luau and Ravi but I don't think any of them is official which was the original question
- darek 6y ago
  Indeed, Teal looks like it has the right brains behind it (author was involved with several earlier attempts at typed Lua) and is actively maintained. I'm personally watching it for future game development usage.
deleted 6y ago
[deleted]
vnogueira 6y ago
I believe he was talking about Pallene, which is being currently developed in LabLua Paper: http://www.inf.puc-rio.br/~roberto/docs/pallene-sblp.pdf http://www.inf.puc-rio.br/~roberto/docs/pallene-sblp.pdf Git Repo: https://github.com/pallene-lang/pallene https://github.com/pallene-lang/pallene

7373737373 6y ago

It's only a matter of time until we have metered WebAssembly in the kernel :)

moring 6y ago
Actually, why not? The main reason that "in the kernel" is concerning is because untrusted code needs some kind of sandboxing, either by static analysis or by run-time checks. (Most modern systems do a combination of both). After all, the whole "in the kernel" vs. "in userland" distinction only exists because we get hardware-accelerated sandboxing from the CPU and OS combined.
- 7373737373 6y ago
  Yeah, my comment is actually unironic :) There are a few ways to limit the execution time of wasm programs: - inject code after a set of instructions with a certain duration and in each loop that calls an external function which meters and destroys/suspends execution when a limit is reached (e.g. https://github.com/ewasm/wasm-metering https://github.com/ewasm/wasm-metering) - use a VM which counts instructions (e.g. https://github.com/perlin-network/life https://github.com/perlin-network/life) - use hardware interrupts More random thoughts: https://esolangs.org/wiki/RarVM https://esolangs.org/wiki/RarVM
m4r35n357 6y ago
We all know the Linux kernel needs a more "engaging" UX . . .
htfy96 6y ago
I guess running an alternative language in kernel is not very challenging. (I tried it two years ago and managed to run i8042 keyboard driver in WebAssembly on Qemu) The hard part is interoperability. Even in languages with automatic C header -> native prototypes conversion capabilities, many kernel features are still not properly handled, especially the macros. Status quo requires the user to manually extract wrappers which could be super tedious.

ivzhh 6y ago

ZFS compiles a modified version Lua 5.2 into zfs.ko and loaded into Linux kernel.

magicalhippo 6y ago
To expand slightly, it's used for "channel programs", scripts that can interact with ZFS to create or modify datasets and similar tasks. There's a write-up here[1] about the feature. Main advantage is that it allows for multiple operations to be applied atomically, as well as better error handling. [1]: https://www.delphix.com/blog/delphix-engineering/zfs-channel-programs https://www.delphix.com/blog/delphix-engineering/zfs-channel...

gnufx 6y ago

What happened to the implementation of a Scheme interpreter in Linux from quite a while back? I can't immediately find a reference, and don't remember details. I vaguely remember there was something similar for SunOS too (in the '90s?).