5 ms·

There's easily thousands of such bugs hidden in the kernel. Reminder the kernel has over ten million LoCs, or megabytes of object code. Perhaps we should star

by snvzz 4y ago

There's easily thousands of such bugs hidden in the kernel. Reminder the kernel has over ten million LoCs, or megabytes of object code. Perhaps we should start thinking about whether it is a good idea to run something this large in supervisor mode, with full privileges. I wouldn't say it is sensible in a world where seL4 exists.

saagarjha 4y ago
Who's going to make seL4 perform comparably to Linux?
- snvzz 4y ago
  Why would we need to slow seL4 down?
  - saagarjha 4y ago
    I'm not really in the mood for trolling.
    - snvzz 4y ago
      The name-calling is uncalled for. To elaborate, seL4 claims to be the fastest kernel around[0], a claim that remains unchallenged. To put it into context, the difference in IPC speed is such that you'd need an order of magnitude more IPC for a multiserver system based on seL4 to actually be slower than Linux. A multiserver design would imply increased IPC use, but not an order of magnitude. 0. https://trustworthy.systems/projects/seL4/ https://trustworthy.systems/projects/seL4/
      - b112 4y ago
        The name-calling is uncalled for. From an observer on the sidelines: there was no namecalling. He said you trolled, not that you ate a troll. The distinction is important. Even the best of us troll, sometimes. (Not claiming you did btw, just that there was no name calling.)
      - camgunz 4y ago
        Sorry I'm pretty naive to this space. I didn't immediately see any performance info on that page save for this paper [0] which shows seL4 competitive with NetBSD, but far from Linux. Is there something else I should look at? [0]: https://trustworthy.systems/publications/full_text/Elphinstone_ZMH_17.pdf https://trustworthy.systems/publications/full_text/Elphinsto...
      - arp242 4y ago
        > To elaborate, seL4 claims to be the fastest kernel around[0], a claim that remains unchallenged. Can I run Firefox or PostgreSQL on seL4? Or another real-world program of comparable complexity? And how does the performance of that compare to Linux or BSD? That's really the only benchmark that matters; it's not hard to be fast if your kernel is simple, but simple is often also less useful. Terry Davis claimed TempleOS was faster than Linux, and in some ways he was right too. But TempleOS is also much more limited than Linux and, in the end, not all that useful – even Terry ran it inside a VM. I've heard these sort of claims about seL4 before, and I've tried to look up some more detailed information about seL4 before, and I've never really found anything convincing on the topic beyond "TempleOS can do loads more context switches than Linux!" type stuff.
      - saagarjha 4y ago
        No, it doesn’t. Here’s the full quote from their website: > seL4 is the world’s fastest operating system kernel designed for security and safety Linux is arguably not designed for security and safety but it blows seL4 out of the water when it comes to performance. There’s a reason it only gets used in contexts where security is critical; I would have expected that you would be aware of this considering you were the one who is promoting it.
        snvzz 4y ago
        >but it blows seL4 out of the water when it comes to performance. Citation needed. And by that I mean actual benchmarks of Linux doing the few tasks seL4 does, such as IPC or context switching, faster than seL4.
        saagarjha 4y ago
        No, you don’t get to define the benchmarks like that. People use an OS so they can run real-world programs on top of it, not spin it in a loop and see how fast it can do IPC. In a monolithic kernel there’s no need to switch contexts for many things; that’s the entire point of using one. I’m sure that seL4 has a perfectly fast implementation of those operations but that’s because it sits and does those all day as part of its basic functionality. Optimizing overhead doesn’t win you extra points when you’re comparing against an OS that doesn’t have it all.
        snvzz 4y ago
        seL4 is an order of magnitude faster at this "overhead" thing. We're talking nanoseconds vs microseconds difference. The multiserver architecture does indeed imply an elevated use of IPC, but it does in no way outweigh the difference in IPC cost. In this model, data sharing, and the implied locking, is minimized, which as a consequence helps SMP scaling. Dragonfly, while not multiserver proper, took a different direction than Freebsd and Linux by optimizing IPC and not implementing fine-grained locks, and instead favoring concurrent lockless and lockfree servers. As a consequence, Dragonfly scales much better than Freebsd, and in many benchmarks manages to outperform Linux. This is despite the tiny development team, particularly so when considered relative to the amount of funding these two systems get. I am sickened by the effort that's being wasted on a model that we know is bad and does not work. Linux will never be high assurance, secure or scale past a certain point. Fortunately, no matter how long it'll take, the better technology will win; there's no "performance hack" that a bad system can pull to catch up with the better technology once it's there. Just a matter of time.
    - deleted 4y ago
      [deleted]
unixhero 4y ago
Well it is the kernel.
Gigachad 4y ago
We really need to be moving faster on migrating Linux to a safer language which prevents these kinds of issues.
0cf8612b2e1e 4y ago
Microkernel does seem the only sensible path forward. Even if the kernel is slowly rustified, going to be playing security whack-a-mole for a long time.
- anonymousiam 4y ago
  Back in the day when the micro-kernel/monolith flamewars were raging, the arguments for monolith were about improved performance and lower memory usage. I haven't seen much discussion on this topic for years, but at least those two arguments have not aged well.
  - aflag 4y ago
    Why not? It isn't clear to me why monolithic kernel wouldn't still have better performance.
    - pjmlp 4y ago
      It doesn't matter with layers hypervisors, virtualization, containers and sandboxes running on top. All mitigations to achieve microkernel like capabilities.
      - aflag 4y ago
        Hm, if you're making the underlying hardware slower, don't you want the kernel to be even faster though? VMs are much more than micro kernels. It's about allowing the user to install whatever they want in their machine. Containers are just a userland abstraction. Not sure where the link to microkernels is there.
        pjmlp 4y ago
        Not when using hypervisor type 1.
        aflag 4y ago
userbinator 4y ago
Alternatively, perhaps we should start thinking about whether it is a good idea to have multiple users of different privilege sharing the same hardware.
- deleted 4y ago
  [deleted]
- thfuran 4y ago
  What's the alternative, just running all code at ring 0?
  - userbinator 4y ago
    IMHO rings 0 + 3 with protections against bugs, and not deliberate malice, is probably the sweet spot.
  - Aerbil313 4y ago
    https://www.theseus-os.com/ https://www.theseus-os.com/
- travis729 4y ago
  I’ve been thinking this recently as well.
- gizmo686 4y ago
  "User" in a modern Linux system is just a weird name for "security domain". Many programs run as their own user to limit their ability to attack the rest of the system if they get compromised; and limit the ability of a different compromised component from attacking them. My desktop, on which I am the only person with an account, has 49 "users", of which 11 are actively running a process. At work, every daemon we run has a dedicated user. On android, every app runs as its own user.
phendrenad2 4y ago
Actually over 30 million LOC
akvadrako 4y ago
It won't make that big of a difference. If you exploit the networking layer you could intercept any local traffic, which will mostly be unencrypted, and communicate with outside attackers. You are probably owned by that point unless you treated localhost as untrusted. It's like why it doesn't matter if you are running as root or not. The user account has access to whats important, like a database or keychain.

by snvzz 4y ago

saagarjha 4y ago

Who's going to make seL4 perform comparably to Linux?

snvzz 4y ago
Why would we need to slow seL4 down?
- saagarjha 4y ago
  I'm not really in the mood for trolling.
  - snvzz 4y ago
    The name-calling is uncalled for. To elaborate, seL4 claims to be the fastest kernel around[0], a claim that remains unchallenged. To put it into context, the difference in IPC speed is such that you'd need an order of magnitude more IPC for a multiserver system based on seL4 to actually be slower than Linux. A multiserver design would imply increased IPC use, but not an order of magnitude. 0. https://trustworthy.systems/projects/seL4/ https://trustworthy.systems/projects/seL4/
    - b112 4y ago
      The name-calling is uncalled for. From an observer on the sidelines: there was no namecalling. He said you trolled, not that you ate a troll. The distinction is important. Even the best of us troll, sometimes. (Not claiming you did btw, just that there was no name calling.)
    - camgunz 4y ago
      Sorry I'm pretty naive to this space. I didn't immediately see any performance info on that page save for this paper [0] which shows seL4 competitive with NetBSD, but far from Linux. Is there something else I should look at? [0]: https://trustworthy.systems/publications/full_text/Elphinstone_ZMH_17.pdf https://trustworthy.systems/publications/full_text/Elphinsto...
    - arp242 4y ago
      > To elaborate, seL4 claims to be the fastest kernel around[0], a claim that remains unchallenged. Can I run Firefox or PostgreSQL on seL4? Or another real-world program of comparable complexity? And how does the performance of that compare to Linux or BSD? That's really the only benchmark that matters; it's not hard to be fast if your kernel is simple, but simple is often also less useful. Terry Davis claimed TempleOS was faster than Linux, and in some ways he was right too. But TempleOS is also much more limited than Linux and, in the end, not all that useful – even Terry ran it inside a VM. I've heard these sort of claims about seL4 before, and I've tried to look up some more detailed information about seL4 before, and I've never really found anything convincing on the topic beyond "TempleOS can do loads more context switches than Linux!" type stuff.
    - saagarjha 4y ago
      No, it doesn’t. Here’s the full quote from their website: > seL4 is the world’s fastest operating system kernel designed for security and safety Linux is arguably not designed for security and safety but it blows seL4 out of the water when it comes to performance. There’s a reason it only gets used in contexts where security is critical; I would have expected that you would be aware of this considering you were the one who is promoting it.
      - snvzz 4y ago
        >but it blows seL4 out of the water when it comes to performance. Citation needed. And by that I mean actual benchmarks of Linux doing the few tasks seL4 does, such as IPC or context switching, faster than seL4.
        saagarjha 4y ago
        No, you don’t get to define the benchmarks like that. People use an OS so they can run real-world programs on top of it, not spin it in a loop and see how fast it can do IPC. In a monolithic kernel there’s no need to switch contexts for many things; that’s the entire point of using one. I’m sure that seL4 has a perfectly fast implementation of those operations but that’s because it sits and does those all day as part of its basic functionality. Optimizing overhead doesn’t win you extra points when you’re comparing against an OS that doesn’t have it all.
        snvzz 4y ago
        seL4 is an order of magnitude faster at this "overhead" thing. We're talking nanoseconds vs microseconds difference. The multiserver architecture does indeed imply an elevated use of IPC, but it does in no way outweigh the difference in IPC cost. In this model, data sharing, and the implied locking, is minimized, which as a consequence helps SMP scaling. Dragonfly, while not multiserver proper, took a different direction than Freebsd and Linux by optimizing IPC and not implementing fine-grained locks, and instead favoring concurrent lockless and lockfree servers. As a consequence, Dragonfly scales much better than Freebsd, and in many benchmarks manages to outperform Linux. This is despite the tiny development team, particularly so when considered relative to the amount of funding these two systems get. I am sickened by the effort that's being wasted on a model that we know is bad and does not work. Linux will never be high assurance, secure or scale past a certain point. Fortunately, no matter how long it'll take, the better technology will win; there's no "performance hack" that a bad system can pull to catch up with the better technology once it's there. Just a matter of time.
  - deleted 4y ago
    [deleted]

unixhero 4y ago

Well it is the kernel.

Gigachad 4y ago

We really need to be moving faster on migrating Linux to a safer language which prevents these kinds of issues.

0cf8612b2e1e 4y ago

Microkernel does seem the only sensible path forward. Even if the kernel is slowly rustified, going to be playing security whack-a-mole for a long time.

anonymousiam 4y ago
Back in the day when the micro-kernel/monolith flamewars were raging, the arguments for monolith were about improved performance and lower memory usage. I haven't seen much discussion on this topic for years, but at least those two arguments have not aged well.
- aflag 4y ago
  Why not? It isn't clear to me why monolithic kernel wouldn't still have better performance.
  - pjmlp 4y ago
    It doesn't matter with layers hypervisors, virtualization, containers and sandboxes running on top. All mitigations to achieve microkernel like capabilities.
    - aflag 4y ago
      Hm, if you're making the underlying hardware slower, don't you want the kernel to be even faster though? VMs are much more than micro kernels. It's about allowing the user to install whatever they want in their machine. Containers are just a userland abstraction. Not sure where the link to microkernels is there.
      - pjmlp 4y ago
        Not when using hypervisor type 1.
        aflag 4y ago

userbinator 4y ago

Alternatively, perhaps we should start thinking about whether it is a good idea to have multiple users of different privilege sharing the same hardware.

deleted 4y ago
[deleted]
thfuran 4y ago
What's the alternative, just running all code at ring 0?
- userbinator 4y ago
  IMHO rings 0 + 3 with protections against bugs, and not deliberate malice, is probably the sweet spot.
- Aerbil313 4y ago
  https://www.theseus-os.com/ https://www.theseus-os.com/
travis729 4y ago
I’ve been thinking this recently as well.
gizmo686 4y ago
"User" in a modern Linux system is just a weird name for "security domain". Many programs run as their own user to limit their ability to attack the rest of the system if they get compromised; and limit the ability of a different compromised component from attacking them. My desktop, on which I am the only person with an account, has 49 "users", of which 11 are actively running a process. At work, every daemon we run has a dedicated user. On android, every app runs as its own user.

phendrenad2 4y ago

Actually over 30 million LOC

akvadrako 4y ago

It won't make that big of a difference. If you exploit the networking layer you could intercept any local traffic, which will mostly be unencrypted, and communicate with outside attackers. You are probably owned by that point unless you treated localhost as untrusted. It's like why it doesn't matter if you are running as root or not. The user account has access to whats important, like a database or keychain.