8 ms·

The last point ("we don't break userspace") has always been a core tenet of Linux. Linus essentially refuses to alter kernel behaviour just to be "correct" acco

by nikanj 3y ago

The last point ("we don't break userspace") has always been a core tenet of Linux. Linus essentially refuses to alter kernel behaviour just to be "correct" according to POSIX lawyers

JdeBP 3y ago
No, that would be the first point. The last point is retaining the status quo simply for the sake of it, which sometimes happens but quite often does not, or out of a misinformed idea of what historically has actually been the case, which happens sometimes too. It's worth noting that being correct according to the SUS would have avoided the problem, since the SUS calls out the applications-code assumptions that cause the vulnerabilities in its rationale.
arp242 3y ago
Linux does break userspace; either when no one would notice (in which case it's arguably not really "breakage") or when there's a serious enough issue that really can't be resolved in any other way. "Don't break userspace" is a hard rule, except when it's not. The question here is: will anyone notice the breakage? And is this a serious enough issue to risk it?
- denotational 3y ago
  > either when no one would notice (in which case it's arguably not really "breakage") This is the idea, but the Kernel maintainers aren’t omniscient, so “no one would notice” really means “the maintainers don’t think anyone would notice”, and this ends up being somewhat arbitrary. A breaking change is a breaking change: just because you don’t think anyone is relying on the existing behaviour doesn’t make it any less of a breaking change. I really don’t like it when Linus says the Kernel never breaks userspace (he says this a lot and uses it as an excuse to abuse people on the mailing list) because it’s just factually inaccurate, and “no one will notice” isn’t really good enough if you expect people to actually rely on this property.
  - ilyt 3y ago
    Well, adding two paragraph long disclaimer where people competent enough know what he means anyway would be counter-productive. The fact it sometimes need to be broken if it is unfixably insecure is obvious conclusion for anyone that thinks about the problem instead of looking for reasons to complain
  - arp242 3y ago
    > “no one would notice” really means “the maintainers don’t think anyone would notice”, and this ends up being somewhat arbitrary. Yeah, that's pretty much what I meant, but this is phrased better than I did. I do think that "Kernel never breaks userspace" is accurate in the common-understanding sense and a good policy to have, even though it's indeed not accurate in the sense that it's "100% technically accurate" (Linux also just breaks things by accident for example). You could use a qualified statement like "Linux takes great care not to break userspace, except when there is a overwhelming case in favour of it, or when we think no real applications will break with it, and we don't always roll back accidental breakage if we don't think it's worth it" and that would be more accurate, but that's rather vague, and a clear "never break userspace" is a much clearer better as a policy for everyone. In interviews and such Linus is of course much more nuanced than "never break userspace".
    - denotational 3y ago
      Yes, I’m splitting hairs over the semantics perhaps. I think given some of Linus’s LKML rants directed at people who have broken userspace, it’s reasonable to take the claim at face value and assume that there is a hard guarantee of backwards compatibility (modulo bugs).
      - arp242 3y ago
        I think people sometimes pay a bit too much attention to "random Linus posts/rants on LKML". As far as I've seen, these kind of outbursts were never the default/standard behaviour but the exception, and I believe Linus toned down a bit in recent years. I'm not fan of his outbursts by any means, but you have to see these things in context. Imagine everything you post on the internet will be read by heaps of people and still be quoted years from now. Often my posts on e.g. HN don't express my full nuanced views either, because it's not germane to the topic at hand, because I phrased things badly, and sometimes I'm just dead wrong. No one quotes all the stupid stuff I said 15 years ago though, or the stupid stuff I said yesterday.
- matheusmoreira 3y ago
  > The question here is: will anyone notice the breakage? Few months ago I wrote a feature request and patch to GNU coreutils that resulted in some discussion of this NULL argv issue. https://lists.gnu.org/archive/html/coreutils/2023-03/msg00002.html https://lists.gnu.org/archive/html/coreutils/2023-03/msg0000... https://lists.gnu.org/archive/html/coreutils/2023-03/msg00004.html https://lists.gnu.org/archive/html/coreutils/2023-03/msg0000... https://lists.gnu.org/archive/html/coreutils/2023-03/msg00010.html https://lists.gnu.org/archive/html/coreutils/2023-03/msg0001... > An edge case is we may want to support allowing to specify a NULL argv[0]. So the GNU developers are aware of this issue. Perhaps they make use of it in other GNU software. Not sure. It seems my patch wasn't accepted to the coreutils. I offered to add support for NULL argv, they said they were deciding what to do but I never got a reply. So env doesn't have this functionality yet.

by nikanj 3y ago

The last point ("we don't break userspace") has always been a core tenet of Linux. Linus essentially refuses to alter kernel behaviour just to be "correct" according to POSIX lawyers

JdeBP 3y ago

No, that would be the first point. The last point is retaining the status quo simply for the sake of it, which sometimes happens but quite often does not, or out of a misinformed idea of what historically has actually been the case, which happens sometimes too. It's worth noting that being correct according to the SUS would have avoided the problem, since the SUS calls out the applications-code assumptions that cause the vulnerabilities in its rationale.

arp242 3y ago

Linux does break userspace; either when no one would notice (in which case it's arguably not really "breakage") or when there's a serious enough issue that really can't be resolved in any other way. "Don't break userspace" is a hard rule, except when it's not. The question here is: will anyone notice the breakage? And is this a serious enough issue to risk it?

denotational 3y ago
> either when no one would notice (in which case it's arguably not really "breakage") This is the idea, but the Kernel maintainers aren’t omniscient, so “no one would notice” really means “the maintainers don’t think anyone would notice”, and this ends up being somewhat arbitrary. A breaking change is a breaking change: just because you don’t think anyone is relying on the existing behaviour doesn’t make it any less of a breaking change. I really don’t like it when Linus says the Kernel never breaks userspace (he says this a lot and uses it as an excuse to abuse people on the mailing list) because it’s just factually inaccurate, and “no one will notice” isn’t really good enough if you expect people to actually rely on this property.
- ilyt 3y ago
  Well, adding two paragraph long disclaimer where people competent enough know what he means anyway would be counter-productive. The fact it sometimes need to be broken if it is unfixably insecure is obvious conclusion for anyone that thinks about the problem instead of looking for reasons to complain
- arp242 3y ago
  > “no one would notice” really means “the maintainers don’t think anyone would notice”, and this ends up being somewhat arbitrary. Yeah, that's pretty much what I meant, but this is phrased better than I did. I do think that "Kernel never breaks userspace" is accurate in the common-understanding sense and a good policy to have, even though it's indeed not accurate in the sense that it's "100% technically accurate" (Linux also just breaks things by accident for example). You could use a qualified statement like "Linux takes great care not to break userspace, except when there is a overwhelming case in favour of it, or when we think no real applications will break with it, and we don't always roll back accidental breakage if we don't think it's worth it" and that would be more accurate, but that's rather vague, and a clear "never break userspace" is a much clearer better as a policy for everyone. In interviews and such Linus is of course much more nuanced than "never break userspace".
  - denotational 3y ago
    Yes, I’m splitting hairs over the semantics perhaps. I think given some of Linus’s LKML rants directed at people who have broken userspace, it’s reasonable to take the claim at face value and assume that there is a hard guarantee of backwards compatibility (modulo bugs).
    - arp242 3y ago
      I think people sometimes pay a bit too much attention to "random Linus posts/rants on LKML". As far as I've seen, these kind of outbursts were never the default/standard behaviour but the exception, and I believe Linus toned down a bit in recent years. I'm not fan of his outbursts by any means, but you have to see these things in context. Imagine everything you post on the internet will be read by heaps of people and still be quoted years from now. Often my posts on e.g. HN don't express my full nuanced views either, because it's not germane to the topic at hand, because I phrased things badly, and sometimes I'm just dead wrong. No one quotes all the stupid stuff I said 15 years ago though, or the stupid stuff I said yesterday.
matheusmoreira 3y ago
> The question here is: will anyone notice the breakage? Few months ago I wrote a feature request and patch to GNU coreutils that resulted in some discussion of this NULL argv issue. https://lists.gnu.org/archive/html/coreutils/2023-03/msg00002.html https://lists.gnu.org/archive/html/coreutils/2023-03/msg0000... https://lists.gnu.org/archive/html/coreutils/2023-03/msg00004.html https://lists.gnu.org/archive/html/coreutils/2023-03/msg0000... https://lists.gnu.org/archive/html/coreutils/2023-03/msg00010.html https://lists.gnu.org/archive/html/coreutils/2023-03/msg0001... > An edge case is we may want to support allowing to specify a NULL argv[0]. So the GNU developers are aware of this issue. Perhaps they make use of it in other GNU software. Not sure. It seems my patch wasn't accepted to the coreutils. I offered to add support for NULL argv, they said they were deciding what to do but I never got a reply. So env doesn't have this functionality yet.