5 ms·

> Drivers which run in kernel space are not allowed anymore to access whatever they want I don't like this. It's one thing to have memory the kernel doesn't us

> Drivers which run in kernel space are not allowed anymore to access whatever they want I don't like this. It's one thing to have memory the kernel doesn't usually need be unmapped by default, but it's another to prevent you from mapping it when you do need it. This reeks of DRM.

colejohnson66 4y ago
Prior to Microsoft changing things with Vista, drivers were free to rummage about and break systems. Blue screens were a common thing back then because drivers weren't careful. It's why Vista had such a bad rap for breaking systems; It exposed the driver authors who didn't care about safety. Also, why does every kernel-safety measure have to be seen as anti-user or DRM? You're free to disable it[0] if you wish, just like Apple's SIP. It's there to keep users who don't know anything safe. Would you like it if an innocent looking piece of software was able to hide itself from the user (read: you) and the OS?[1] Preventing such attacks doesn't sound anti-user to me. [0]: https://windowsloop.com/disable-enable-device-guard-windows-10/ https://windowsloop.com/disable-enable-device-guard-windows-... [1]: https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
- blibble 4y ago
  > Also, why does every kernel-safety measure have to be seen as anti-user or DRM? You're free to disable it[0] if you wish, OP's point was about kernel patch protection how do I disable that?
matheusmoreira 4y ago
No idea why you're being downvoted. This does sound like an anti-user feature. Stuff like this exists to protect third party software from our analysis and "tampering".
- dagmx 4y ago
  Can you elaborate how this feels anti-user?
  - matheusmoreira 4y ago
    As the owner of the machine, I should have total access to everything. There should be no protected memory I can't read, no execution I can't trace. The number one user of such security features are "rights holders" that consider me hostile and want to protect their software from me, the owner of the machine it is running on. The result is a computer that is factory pwned. It's not really my computer, they're just "generously" allowing me to run software on it as long as it doesn't harm their bottom line. Virtualization based security, the technology enabling this, also enables DRM. It is currently required by Netflix for 4k resolution streaming.
    - threeseed 4y ago
      > I should have total access to everything You do have total access. You chose to install an OS that wants to limit it.
    - dagmx 4y ago
      How do you propose having security in that world? Should any process be able to access the memory of any other process? Should you opening a web page allow you a security issue there to be able to access your running applications? I guess my question is, you seem to have a very hardline “everything” take that I don’t think extends to the real world
      - mckeed 4y ago
        Still build the security protections but allow the administrator to selectively disable/override them.
      - josephcsible 4y ago
        You're confusing "I" should have access to all the data on my machine, with "anything running on my machine" should have access to all the data on my machine.
- marcosdumay 4y ago
  It is anti-driver-freedom. Most users don't want driver-freedom. They want user-freedom, that is easily achieved by keeping the kernel open source and replaceable. If you want to break some in-kernel protection, you can just patch the kernel and remove it.
  - josephcsible 4y ago
    > They want user-freedom, that is easily achieved by keeping the kernel open source and replaceable. The original comment I replied to was about the Windows kernel.
0xbadcafebee 4y ago
> but it's another to prevent you from mapping it when you do need it How do you know if it's a user needing to use it, or an attacker pretending to be a user needing to use it?
- josephcsible 4y ago
  I'm willing to accept that if a malicious kernel driver gets loaded, I'm completely pwned.

colejohnson66 4y ago

Prior to Microsoft changing things with Vista, drivers were free to rummage about and break systems. Blue screens were a common thing back then because drivers weren't careful. It's why Vista had such a bad rap for breaking systems; It exposed the driver authors who didn't care about safety. Also, why does every kernel-safety measure have to be seen as anti-user or DRM? You're free to disable it[0] if you wish, just like Apple's SIP. It's there to keep users who don't know anything safe. Would you like it if an innocent looking piece of software was able to hide itself from the user (read: you) and the OS?[1] Preventing such attacks doesn't sound anti-user to me. [0]: https://windowsloop.com/disable-enable-device-guard-windows-10/ https://windowsloop.com/disable-enable-device-guard-windows-... [1]: https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

blibble 4y ago
> Also, why does every kernel-safety measure have to be seen as anti-user or DRM? You're free to disable it[0] if you wish, OP's point was about kernel patch protection how do I disable that?

matheusmoreira 4y ago

No idea why you're being downvoted. This does sound like an anti-user feature. Stuff like this exists to protect third party software from our analysis and "tampering".

dagmx 4y ago
Can you elaborate how this feels anti-user?
- matheusmoreira 4y ago
  As the owner of the machine, I should have total access to everything. There should be no protected memory I can't read, no execution I can't trace. The number one user of such security features are "rights holders" that consider me hostile and want to protect their software from me, the owner of the machine it is running on. The result is a computer that is factory pwned. It's not really my computer, they're just "generously" allowing me to run software on it as long as it doesn't harm their bottom line. Virtualization based security, the technology enabling this, also enables DRM. It is currently required by Netflix for 4k resolution streaming.
  - threeseed 4y ago
    > I should have total access to everything You do have total access. You chose to install an OS that wants to limit it.
  - dagmx 4y ago
    How do you propose having security in that world? Should any process be able to access the memory of any other process? Should you opening a web page allow you a security issue there to be able to access your running applications? I guess my question is, you seem to have a very hardline “everything” take that I don’t think extends to the real world
    - mckeed 4y ago
      Still build the security protections but allow the administrator to selectively disable/override them.
    - josephcsible 4y ago
      You're confusing "I" should have access to all the data on my machine, with "anything running on my machine" should have access to all the data on my machine.
marcosdumay 4y ago
It is anti-driver-freedom. Most users don't want driver-freedom. They want user-freedom, that is easily achieved by keeping the kernel open source and replaceable. If you want to break some in-kernel protection, you can just patch the kernel and remove it.
- josephcsible 4y ago
  > They want user-freedom, that is easily achieved by keeping the kernel open source and replaceable. The original comment I replied to was about the Windows kernel.

0xbadcafebee 4y ago

> but it's another to prevent you from mapping it when you do need it How do you know if it's a user needing to use it, or an attacker pretending to be a user needing to use it?

josephcsible 4y ago
I'm willing to accept that if a malicious kernel driver gets loaded, I'm completely pwned.