4 ms·
Normally the identity of contributors is not really checked when you want to contribute to an open source project. A valid email address and a name is sufficien
by haukem 6y ago
Normally the identity of contributors is not really checked when you want to contribute to an open source project. A valid email address and a name is sufficient to contribute to the Linux kernel.
All changes to The Linux kernel are getting publicly reviewed, so the hard thing is passing this technical review if you want to introduce a backdoor.
If people know you, based on previous contributions, the review could be less hard, so it could make sense to build up a reputation before. In the Linux kernel not the company builds up the reputation, but the individual engineer who contributes. If this is a Huawei hardware it could be easier for an engineer with a Huawei mail address to get changes integrated, because people assume he known the driver and hardware well and people trust claims like, "this can not happen because the closed source firmware takes care of this".
If the Chinese intelligence agency wants to integrate a backdoor into mainline Linux it would be easier to just build up some own fake identities and use them. It probably would be easier to just analyze the Linux kernel and use bugs introduced by other people.
The NSA also contributed to the Linux kernel, look for contributes from a nsa.gov mail address.
- LinuxBender 6y agoI would expect that malicious code would itself not be a proper backdoor, but rather a framework or hook or API that makes it easier to bypass restrictions. Subtle behavioral changes in the kernel combined with user space code could empower a state actor to move unnoticed. I think of it like 20 parts of a munition. Each piece by itself may look mostly harmless. This is all theory of course, but that is how I would do something malicious in the kernel. A theoretical example would be a simple kernel API combined with something like systemd's binfmt mount and a benign looking PNG image file that when parsed by binfmt, instructs the kernel to do something interesting such as tickle an undocumented CPU instruction.
- dcolkitt 6y agoNot just contributed. SELinux is primarily authored by the NSA.
- haukem 6y agoNow Huawei is fixing bugs in SELinux: https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e4de7b7db5 https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e... Or reports them, so the NSA can fix them: https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5fa730e936 https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5...