8 ms·

It's like a bunch of people correctly predicted a few months ago that maybe this kind of attack surface shouldn't be added into the kernel: https://news.ycombin

It's like a bunch of people correctly predicted a few months ago that maybe this kind of attack surface shouldn't be added into the kernel: https://news.ycombinator.com/item?id=28355754 https://news.ycombinator.com/item?id=28355754

rektide 4y ago
[flagged]
- tpush 4y ago
  Sincerely, what the hell are you even talking about? You are literally commenting on a kernel RCE enabled by putting this stuff in the kernel!
  - anonymousiam 4y ago
    It's obviously a GPT-3 generated comment.
    - jacquesm 4y ago
      If you're lucky.
  - rektide 4y ago
    For an extremely limited number of users who rely on one specific use of this feature. It'll get fixed, quickly, and we'll move on. Your reaction seems way overblown to me. Maybe you are sticking to your guns here. But to me, considering the real scope of damage & threat here, this seems unfortunate, sad, avoidable, and bad, but for a new implementation of a massive sprawling wild protocol, I'd far rather we try than just throw up our hands & let bravery fold. We should do hard things, even when we can't have absolute confidence in total success.
    - rektide 4y ago
      So much downvoting! Make a case. Why do you all disagree so vehemently? What has you so very very concerned?
bombcar 4y ago
Maybe if you want to do SMB in kernel-space they should be using the rust bindings
- flatiron 4y ago
  Rust is driver only…for now
  - sanxiyn 4y ago
    Well, one thing written to test-drive Rust for Linux was in-kernel server for 9P, which is probably the closest thing to ksmbd, in-kernel server for SMB, without being identical: https://lwn.net/Articles/907685/ https://lwn.net/Articles/907685/
    - ilyt 4y ago
      This is hilarious: > Initially, he had started trying to replace the ksmbd server, but that turned out to not be an ideal project. if only he perservered...
  - deleted 4y ago
    [deleted]
- howinteresting 4y ago
  Quite frankly any new kernel code that interacts with the network, or untrusted data in general, should use Rust to the greatest extent possible.
  - dinkumthinkum 4y ago
    Why? Is it because you think Rust code in the kernel is memory safe?
    - howinteresting 4y ago
      It is definitely, undisputably memory safer.
usr1106 4y ago
So if it weren't in the kernel it would need to run as root, wouldn't it? That gives the attacker nearly the same rights but a much more convenient programming environment.
- fragmede 4y ago
  With CAP_NET_BIND_SERVICE, it doesn't need to be run as root.
  - ilyt 4y ago
    And without it can just bind socket then change UID
  - usr1106 4y ago
    Binding to a low socket is one thing. But as a file server it needs to access many users' files. That can be done without being root, too. Reducing the attack surface on one end but weakening things a bit on the other. A net gain I might concede, but not completely black and white.
fh973 4y ago
The kernel desperately needs a product manager, who says no.
_8j50 4y ago
SMB is a complex network protocol, implementing it without a serious bug somewhere is a serious challenge. Kerberos is another complicated protocol. You have user space FS modules, perhaps it would have been better to make it one? But at the same time you have stuff like TLS ans wireguard in the kernel (SMB is still more complicated imho). Linux being monolithic and all, I don't think there is a good answer. Hope Microkernels make a comeback.
- ryao 4y ago
  I am not sure what was so bad about Samba. It was performing better than ksmbd in the sequential access patterns that it typically has: https://samba.plus/blog/detail/ksmbd-a-new-in-kernel-smb-server https://samba.plus/blog/detail/ksmbd-a-new-in-kernel-smb-ser...
  - _8j50 4y ago
    Samba also had many severe rce vulns over the years.
ryao 4y ago
It is almost as if Linux is trying to catch up to Windows in attack surface: https://arstechnica.com/information-technology/2022/12/critical-windows-code-execution-vulnerability-went-undetected-until-now/ https://arstechnica.com/information-technology/2022/12/criti...
- trasz3 4y ago
  Similar incentives and assumptions lead to similar results.

rektide 4y ago

[flagged]

tpush 4y ago
Sincerely, what the hell are you even talking about? You are literally commenting on a kernel RCE enabled by putting this stuff in the kernel!
- anonymousiam 4y ago
  It's obviously a GPT-3 generated comment.
  - jacquesm 4y ago
    If you're lucky.
- rektide 4y ago
  For an extremely limited number of users who rely on one specific use of this feature. It'll get fixed, quickly, and we'll move on. Your reaction seems way overblown to me. Maybe you are sticking to your guns here. But to me, considering the real scope of damage & threat here, this seems unfortunate, sad, avoidable, and bad, but for a new implementation of a massive sprawling wild protocol, I'd far rather we try than just throw up our hands & let bravery fold. We should do hard things, even when we can't have absolute confidence in total success.
  - rektide 4y ago
    So much downvoting! Make a case. Why do you all disagree so vehemently? What has you so very very concerned?

bombcar 4y ago

Maybe if you want to do SMB in kernel-space they should be using the rust bindings

flatiron 4y ago
Rust is driver only…for now
- sanxiyn 4y ago
  Well, one thing written to test-drive Rust for Linux was in-kernel server for 9P, which is probably the closest thing to ksmbd, in-kernel server for SMB, without being identical: https://lwn.net/Articles/907685/ https://lwn.net/Articles/907685/
  - ilyt 4y ago
    This is hilarious: > Initially, he had started trying to replace the ksmbd server, but that turned out to not be an ideal project. if only he perservered...
- deleted 4y ago
  [deleted]
howinteresting 4y ago
Quite frankly any new kernel code that interacts with the network, or untrusted data in general, should use Rust to the greatest extent possible.
- dinkumthinkum 4y ago
  Why? Is it because you think Rust code in the kernel is memory safe?
  - howinteresting 4y ago
    It is definitely, undisputably memory safer.

usr1106 4y ago

So if it weren't in the kernel it would need to run as root, wouldn't it? That gives the attacker nearly the same rights but a much more convenient programming environment.

fragmede 4y ago
With CAP_NET_BIND_SERVICE, it doesn't need to be run as root.
- ilyt 4y ago
  And without it can just bind socket then change UID
- usr1106 4y ago
  Binding to a low socket is one thing. But as a file server it needs to access many users' files. That can be done without being root, too. Reducing the attack surface on one end but weakening things a bit on the other. A net gain I might concede, but not completely black and white.

fh973 4y ago

The kernel desperately needs a product manager, who says no.

_8j50 4y ago

SMB is a complex network protocol, implementing it without a serious bug somewhere is a serious challenge. Kerberos is another complicated protocol. You have user space FS modules, perhaps it would have been better to make it one? But at the same time you have stuff like TLS ans wireguard in the kernel (SMB is still more complicated imho). Linux being monolithic and all, I don't think there is a good answer. Hope Microkernels make a comeback.

ryao 4y ago
I am not sure what was so bad about Samba. It was performing better than ksmbd in the sequential access patterns that it typically has: https://samba.plus/blog/detail/ksmbd-a-new-in-kernel-smb-server https://samba.plus/blog/detail/ksmbd-a-new-in-kernel-smb-ser...
- _8j50 4y ago
  Samba also had many severe rce vulns over the years.

ryao 4y ago

It is almost as if Linux is trying to catch up to Windows in attack surface: https://arstechnica.com/information-technology/2022/12/critical-windows-code-execution-vulnerability-went-undetected-until-now/ https://arstechnica.com/information-technology/2022/12/criti...

trasz3 4y ago
Similar incentives and assumptions lead to similar results.