4 ms·

Linux Kernel Defence Map – Security Hardening Concepts

159 points by transpute 2y ago

nine_k 2y ago
The number of defenses is pretty impressive. The number of out-of-tree and commercial defenses is also impressive. The amount dedicated to specifics of C (UB, bounds checks, use-after-free) is relatively small. It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features.
- zie 2y ago
  > It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features. I'm not sure that would be a very fair comparison. A lot of OpenBSD security comes from just skipping giant swaths of stuff. Advanced filesystems are non-existent, Bluetooth is non-existent, etc. I haven't done a count lately, but I would guess the Linux Kernel alone is larger than the OpenBSD base system. It's simplicity is a huge security feature. Provided you don't need some of those features. I'm not saying this as an OpenBSD hater or anything, I run OpenBSD on at least one machine.
acje 2y ago
I find it inspiring that we are getting to where we are dealing with models that classify vulnerabilities at a systems level. However I also think we are kind of barking up the wrong three. There is IMHO something wrong with the current strategy of scaling up the von Neumann architecture. It leads to fragile software partitioning, noisy neighbors and both slow and sometimes unintended communication through shared memory. I’ve tried to lay this out in detail here https://lnkd.in/dRNSYPWC https://lnkd.in/dRNSYPWC
- simonask 2y ago
  I think your take is interesting, but your article does not go into details with ideas about how to address these problems at the architectural level. Would you like to elaborate?
  - acje 2y ago
    There is some elaboration in part four of the series. A fifth part on actor model, gaps and surfaces is in the works. Part four https://lnkd.in/dEVabpkN https://lnkd.in/dEVabpkN
- transpute 2y ago
  Have you looked at Barrelfish (2011) from Microsoft Research and ETH Zurich? https://www.microsoft.com/en-us/research/blog/barrelfish-exploring-multicore-os/ https://www.microsoft.com/en-us/research/blog/barrelfish-exp... > “In the next five to 10 years,” Barham predicts, “there are going to be many varieties of multicore machines. There are going to be a small number of each type of machine, and you won’t be able to afford to spend two years rewriting an operating system to work on each new machine that comes out. Trying to write the OS so it can be installed on a completely new computer it’s never seen before, measure things, and think about the best way to optimize itself on this computer—that’s quite a different approach to making an operating system for a single, specific multiprocessor.” The problem, the researchers say, stems from the use of a shared-memory kernel with data structures protected by locks. The Barrelfish project opts instead for a distributed system in which each unit communicates explicitly. Public development stopped in March 2020, https://github.com/BarrelfishOS/barrelfish https://github.com/BarrelfishOS/barrelfish & https://barrelfish.org https://barrelfish.org
  - nand_gate 2y ago
    Vapourware, what they post (microkernels) is nothing new. As far as a barrel CPUs to replace SMT... crickets
    - pjmlp 2y ago
      It is on most mainstream computers, even though it is the way in most high integrity computing deployments.
    - transpute 2y ago
      10 years of shipped code for multiple platforms (x86, ARMv7, ARMv8) is not varporware. Based on software experience with existing platforms, they have created an open hardware RISC-V core which requires custom software to achieve energy effiency with improved performance, https://spectrum.ieee.org/snitch-riscv-processor-6x-faster https://spectrum.ieee.org/snitch-riscv-processor-6x-faster > Snitch proved to be 3.5 times more energy efficient and up to six times faster than the others.. "While we could already demonstrate a very energy-efficient and versatile 8-core Snitch cluster configuration in silicon, there are exciting opportunities ahead in building computing platforms scalable to thousands of Snitch cores, even spreading over multiple chiplets," says Zaruba, noting that his team is currently working towards this goal. https://github.com/pulp-platform/snitch https://github.com/pulp-platform/snitch
chenhoey1211 2y ago
Really solid conceptual map — not just for kernel devs, but also useful if you're working in Rust, Zig, or any low-level system code. Has anyone come across a similar visual breakdown for Wasm runtimes, especially around sandboxing and isolation models?
anthonyryan1 2y ago
This is by the author of the very helpful kernel-hardening-checker: https://github.com/a13xp0p0v/kernel-hardening-checker https://github.com/a13xp0p0v/kernel-hardening-checker An interesting tool for analyzing your personal kernel config file and pointing out areas for security improvement. It's more comprehensive than KSPP (https://kspp.github.io/ https://kspp.github.io/) but sometimes goes a little too far, suggesting disabling kernel features you may actively use. Definitely worth trying!
- egberts1 2y ago
  This is the way. Close all avenues, then only open what you exactly need.
  - anon6362 2y ago
    By default, Linux has way, way too much functionality, insufficient testing and proof of security correctness, and not enough security controls.
Sponge5 2y ago
> This map describes kernel security hardening. It doesn't cover cutting attack surface. For those wondering why SECCOMP is ommited.
hart_russell 2y ago
Do these settings persist if I update the kernel on my ubuntu server?

159 points by transpute 2y ago

The number of defenses is pretty impressive. The number of out-of-tree and commercial defenses is also impressive. The amount dedicated to specifics of C (UB, bounds checks, use-after-free) is relatively small. It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features.

zie 2y ago
> It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features. I'm not sure that would be a very fair comparison. A lot of OpenBSD security comes from just skipping giant swaths of stuff. Advanced filesystems are non-existent, Bluetooth is non-existent, etc. I haven't done a count lately, but I would guess the Linux Kernel alone is larger than the OpenBSD base system. It's simplicity is a huge security feature. Provided you don't need some of those features. I'm not saying this as an OpenBSD hater or anything, I run OpenBSD on at least one machine.

acje 2y ago

I find it inspiring that we are getting to where we are dealing with models that classify vulnerabilities at a systems level. However I also think we are kind of barking up the wrong three. There is IMHO something wrong with the current strategy of scaling up the von Neumann architecture. It leads to fragile software partitioning, noisy neighbors and both slow and sometimes unintended communication through shared memory. I’ve tried to lay this out in detail here https://lnkd.in/dRNSYPWC https://lnkd.in/dRNSYPWC

simonask 2y ago
I think your take is interesting, but your article does not go into details with ideas about how to address these problems at the architectural level. Would you like to elaborate?
- acje 2y ago
  There is some elaboration in part four of the series. A fifth part on actor model, gaps and surfaces is in the works. Part four https://lnkd.in/dEVabpkN https://lnkd.in/dEVabpkN
transpute 2y ago
Have you looked at Barrelfish (2011) from Microsoft Research and ETH Zurich? https://www.microsoft.com/en-us/research/blog/barrelfish-exploring-multicore-os/ https://www.microsoft.com/en-us/research/blog/barrelfish-exp... > “In the next five to 10 years,” Barham predicts, “there are going to be many varieties of multicore machines. There are going to be a small number of each type of machine, and you won’t be able to afford to spend two years rewriting an operating system to work on each new machine that comes out. Trying to write the OS so it can be installed on a completely new computer it’s never seen before, measure things, and think about the best way to optimize itself on this computer—that’s quite a different approach to making an operating system for a single, specific multiprocessor.” The problem, the researchers say, stems from the use of a shared-memory kernel with data structures protected by locks. The Barrelfish project opts instead for a distributed system in which each unit communicates explicitly. Public development stopped in March 2020, https://github.com/BarrelfishOS/barrelfish https://github.com/BarrelfishOS/barrelfish & https://barrelfish.org https://barrelfish.org
- nand_gate 2y ago
  Vapourware, what they post (microkernels) is nothing new. As far as a barrel CPUs to replace SMT... crickets
  - pjmlp 2y ago
    It is on most mainstream computers, even though it is the way in most high integrity computing deployments.
  - transpute 2y ago
    10 years of shipped code for multiple platforms (x86, ARMv7, ARMv8) is not varporware. Based on software experience with existing platforms, they have created an open hardware RISC-V core which requires custom software to achieve energy effiency with improved performance, https://spectrum.ieee.org/snitch-riscv-processor-6x-faster https://spectrum.ieee.org/snitch-riscv-processor-6x-faster > Snitch proved to be 3.5 times more energy efficient and up to six times faster than the others.. "While we could already demonstrate a very energy-efficient and versatile 8-core Snitch cluster configuration in silicon, there are exciting opportunities ahead in building computing platforms scalable to thousands of Snitch cores, even spreading over multiple chiplets," says Zaruba, noting that his team is currently working towards this goal. https://github.com/pulp-platform/snitch https://github.com/pulp-platform/snitch

chenhoey1211 2y ago

Really solid conceptual map — not just for kernel devs, but also useful if you're working in Rust, Zig, or any low-level system code. Has anyone come across a similar visual breakdown for Wasm runtimes, especially around sandboxing and isolation models?

anthonyryan1 2y ago

This is by the author of the very helpful kernel-hardening-checker: https://github.com/a13xp0p0v/kernel-hardening-checker https://github.com/a13xp0p0v/kernel-hardening-checker An interesting tool for analyzing your personal kernel config file and pointing out areas for security improvement. It's more comprehensive than KSPP (https://kspp.github.io/ https://kspp.github.io/) but sometimes goes a little too far, suggesting disabling kernel features you may actively use. Definitely worth trying!

egberts1 2y ago
This is the way. Close all avenues, then only open what you exactly need.
- anon6362 2y ago
  By default, Linux has way, way too much functionality, insufficient testing and proof of security correctness, and not enough security controls.

Sponge5 2y ago

> This map describes kernel security hardening. It doesn't cover cutting attack surface. For those wondering why SECCOMP is ommited.

hart_russell 2y ago

Do these settings persist if I update the kernel on my ubuntu server?