4 ms·

I've thought about implementing this before (in a systemd alternative), but there are some good reasons to reboot. The kernel does leak, and only rebooting user

I've thought about implementing this before (in a systemd alternative), but there are some good reasons to reboot. The kernel does leak, and only rebooting user space is a force multiplier for certain types of attacks where userspace is limited to an action a finite number of times per boot. One recent article that comes to mind is this (though incrementing the counter here doesn't need a reboot to get hit): https://googleprojectzero.blogspot.com/2023/01/exploiting-null-dereferences-in-linux.html?m=1 https://googleprojectzero.blogspot.com/2023/01/exploiting-nu... The other thing is that not rebooting the kernel removes the pressure on the kernel developers to reboot quickly. If people depend on it less, that can regress. systemd is big enough to affect that.

westurner 3y ago
pivot_root doesn't replace the kernel or its state either. https://www.google.com/search?q=pivot_root https://www.google.com/search?q=pivot_root How much state is there in a kernel? Ksplice > See also lists kexec, kGraft, kpatch, and KernelCare: https://en.wikipedia.org/wiki/Ksplice#See_also https://en.wikipedia.org/wiki/Ksplice#See_also Kgraft: https://en.wikipedia.org/wiki/KGraft https://en.wikipedia.org/wiki/KGraft Live migration: https://en.wikipedia.org/wiki/Live_migration https://en.wikipedia.org/wiki/Live_migration libvirt: Guest migration > Offline migration: https://libvirt.org/migration.html#offline-migration https://libvirt.org/migration.html#offline-migration Memory forensics: https://en.wikipedia.org/wiki/Memory_forensics https://en.wikipedia.org/wiki/Memory_forensics : Volatility awesome-forensics > acquisition: https://github.com/cugu/awesome-forensics#acquisition https://github.com/cugu/awesome-forensics#acquisition : Memory forensics acquisition tools: AVML, POFR: PenguinOS Flight Recorder, LIME
naruhodo 3y ago
It makes me wonder if the kernel is able to "reboot" parts of itself.
- s1gsegv 3y ago
  Through the same sort of mechanisms you can unload and reload a module, you could definitely consider that "rebooting". In practice, however, there are definitely modules that don't support unloading, or claim to support it but don't actually clean up after themselves very well.

westurner 3y ago

pivot_root doesn't replace the kernel or its state either. https://www.google.com/search?q=pivot_root https://www.google.com/search?q=pivot_root How much state is there in a kernel? Ksplice > See also lists kexec, kGraft, kpatch, and KernelCare: https://en.wikipedia.org/wiki/Ksplice#See_also https://en.wikipedia.org/wiki/Ksplice#See_also Kgraft: https://en.wikipedia.org/wiki/KGraft https://en.wikipedia.org/wiki/KGraft Live migration: https://en.wikipedia.org/wiki/Live_migration https://en.wikipedia.org/wiki/Live_migration libvirt: Guest migration > Offline migration: https://libvirt.org/migration.html#offline-migration https://libvirt.org/migration.html#offline-migration Memory forensics: https://en.wikipedia.org/wiki/Memory_forensics https://en.wikipedia.org/wiki/Memory_forensics : Volatility awesome-forensics > acquisition: https://github.com/cugu/awesome-forensics#acquisition https://github.com/cugu/awesome-forensics#acquisition : Memory forensics acquisition tools: AVML, POFR: PenguinOS Flight Recorder, LIME

naruhodo 3y ago

It makes me wonder if the kernel is able to "reboot" parts of itself.

s1gsegv 3y ago
Through the same sort of mechanisms you can unload and reload a module, you could definitely consider that "rebooting". In practice, however, there are definitely modules that don't support unloading, or claim to support it but don't actually clean up after themselves very well.