4 ms·

OpenBSD drops loadable kernel module support

40 points by antonios 12y ago

erkose 12y ago
Anyone know of a link to the rationale?
- justincormack 12y ago
  I think it was only being used to load policies into pf, and that was no longer needed as the useful policies were all included. That may have been a comment from the latest episode of bsdnow.tv, or a discussion I had recently I forget which sorry...
- boardstretcher 12y ago
  Not a link, but I can tell you that one of the philosphies OpenBSD dev's enjoy is 'trim useless code for maintainability and security.' LKM hasn't been worked on, improved on, or maintained in any significant way, so... it went away. There won't be any fanfare made about it officially, because the dev group didn't seem to care about it anymore. Anything un-needed or considered bloat in OpenBSD goes this route eventually,. not with a bang but a whimper. edit: Having looked at the article, it seems a bit sensationalized by Phoronix. Unfortunately the OpenBSD maintainers didn't care as much as this writer at Phoronix seems to have done.
- imanaccount247 12y ago
  Can't link to it because it is such a non-issue that nobody would even mention it. They just removed some dead code. OpenBSD has not used the kernel modules system in 15+ years. This is only "news" because people unfamiliar with openbsd assume it is like linux and must use modules. It is not and does not.
typedweb 12y ago
Loadable kernel modules have long been known to be the source of potential security risks due to the fact that the kernel now has a way to intentionally load code into itself. A project like OpenBSD to me should never have included this feature in the first place, but I hear the mechanism that is being dropped is and old and obsolete version that nobody ever used.
- mcosta 12y ago
  > is and old and obsolete version that nobody ever used. Is there another mechanism? If not, I see this as a step backwards.
  - imanaccount247 12y ago
    If you see it as a step backwards, then you've obviously never used openbsd, so why would they care? It is a completely unnecessary "feature" that has not been used at all in at least 15 years.
orik 12y ago
Here's a link to the phoronix article on the change. There's a bit of discussion about it in the comments as well. http://www.phoronix.com/scan.php?page=news_item&px=MTgyNDI http://www.phoronix.com/scan.php?page=news_item&px=MTgyNDI
ChuckMcM 12y ago
Various folks, such as this site: http://geodsoft.com/howto/harden/OpenBSD/kernel.htm http://geodsoft.com/howto/harden/OpenBSD/kernel.htm have suggested turning of loadable kernel modules to harden a kernel. The two things that loadable modules provide (runtime configuration, and third party proprietary code support) are not that valuable. I've always turned off loadable modules when I've build custom BSD kernels for servers for exactly that reason. I get around the propietary code issue by making sure the server I configure has hardware for which non-proprietary and/or source available drivers exist. Which for servers is generally network and disk drivers so pretty easy.
- tkinom 12y ago
  Are they going to build all the supported HW device drivers all into the kernel image? Serial Drivers, all the USB related drivers, all the printers, networks card, graphics card driver? How big will the new kernel image be? It also make dev/debugging driver task much harder as it requires complete reboot system to test it. Also, what about FS? such as ZFS? Build in by default, disable by default, load and reboot different kernel everytime I need something?
  - _delirium 12y ago
    OpenBSD strongly discourages non-default kernel configurations [1], so anything they consider supported is just compiled in to the default kernel. [1] http://www.openbsd.com/faq/faq5.html#Why http://www.openbsd.com/faq/faq5.html#Why
  - imanaccount247 12y ago
    >Are they going to build all the supported HW device drivers all into the kernel image? They always have. No drivers were modules. Modules were just there because netbsd had them. Kernel modules were already not being used at all in OpenBSD, they are removing an unused "feature".
  - ChuckMcM 12y ago
    > Are they going to build all the supported HW device > drivers all into the kernel image? Historically that was what the 'Generic' kernel was, something which would boot on any system. A typical system configuration would be to boot the generic kernel, edit the configuration file to select only those devices and features that were going to be used, config and then make that kernel. Then boot from the configured kernel from then on. There has been both a lot of research and debate about various 'microkernel' strategies where the core of the micro-kernel really only knows how to access the boot disk and load modules. Then as hardware is probed and discovered, modules to support that hardware is loaded. As a desktop machine kernel, micro-kernels allow for changes in the hardware configuration to occur fairly easily without a lot of user visible fuss. But they do leave open the vulnerability that the module system can be exploited. Server systems generally change less frequently and hardware changes beyond adding or removing a disk drive are often quite rare. Things are always trade-offs. I wonder if there is anyone doing mixed virtualization studies. Using a hypervisor that is locked down for the lower layer and then booting the "user" machine for interactive use. This is a very powerful architectural choice and was been used for decades in IBM's mainframe OS. Perhaps we'll see a consumer OS based on those principles at some point.
parfe 12y ago
34 linux users upvoted this article. OpenBSD is not Linux. The "story" is a non-event in OpenBSD world.

40 points by antonios 12y ago

erkose 12y ago

Anyone know of a link to the rationale?

justincormack 12y ago
I think it was only being used to load policies into pf, and that was no longer needed as the useful policies were all included. That may have been a comment from the latest episode of bsdnow.tv, or a discussion I had recently I forget which sorry...
boardstretcher 12y ago
Not a link, but I can tell you that one of the philosphies OpenBSD dev's enjoy is 'trim useless code for maintainability and security.' LKM hasn't been worked on, improved on, or maintained in any significant way, so... it went away. There won't be any fanfare made about it officially, because the dev group didn't seem to care about it anymore. Anything un-needed or considered bloat in OpenBSD goes this route eventually,. not with a bang but a whimper. edit: Having looked at the article, it seems a bit sensationalized by Phoronix. Unfortunately the OpenBSD maintainers didn't care as much as this writer at Phoronix seems to have done.
imanaccount247 12y ago
Can't link to it because it is such a non-issue that nobody would even mention it. They just removed some dead code. OpenBSD has not used the kernel modules system in 15+ years. This is only "news" because people unfamiliar with openbsd assume it is like linux and must use modules. It is not and does not.

typedweb 12y ago

Loadable kernel modules have long been known to be the source of potential security risks due to the fact that the kernel now has a way to intentionally load code into itself. A project like OpenBSD to me should never have included this feature in the first place, but I hear the mechanism that is being dropped is and old and obsolete version that nobody ever used.

mcosta 12y ago
> is and old and obsolete version that nobody ever used. Is there another mechanism? If not, I see this as a step backwards.
- imanaccount247 12y ago
  If you see it as a step backwards, then you've obviously never used openbsd, so why would they care? It is a completely unnecessary "feature" that has not been used at all in at least 15 years.

orik 12y ago

Here's a link to the phoronix article on the change. There's a bit of discussion about it in the comments as well. http://www.phoronix.com/scan.php?page=news_item&px=MTgyNDI http://www.phoronix.com/scan.php?page=news_item&px=MTgyNDI

ChuckMcM 12y ago

Various folks, such as this site: http://geodsoft.com/howto/harden/OpenBSD/kernel.htm http://geodsoft.com/howto/harden/OpenBSD/kernel.htm have suggested turning of loadable kernel modules to harden a kernel. The two things that loadable modules provide (runtime configuration, and third party proprietary code support) are not that valuable. I've always turned off loadable modules when I've build custom BSD kernels for servers for exactly that reason. I get around the propietary code issue by making sure the server I configure has hardware for which non-proprietary and/or source available drivers exist. Which for servers is generally network and disk drivers so pretty easy.

tkinom 12y ago
Are they going to build all the supported HW device drivers all into the kernel image? Serial Drivers, all the USB related drivers, all the printers, networks card, graphics card driver? How big will the new kernel image be? It also make dev/debugging driver task much harder as it requires complete reboot system to test it. Also, what about FS? such as ZFS? Build in by default, disable by default, load and reboot different kernel everytime I need something?
- _delirium 12y ago
  OpenBSD strongly discourages non-default kernel configurations [1], so anything they consider supported is just compiled in to the default kernel. [1] http://www.openbsd.com/faq/faq5.html#Why http://www.openbsd.com/faq/faq5.html#Why
- imanaccount247 12y ago
  >Are they going to build all the supported HW device drivers all into the kernel image? They always have. No drivers were modules. Modules were just there because netbsd had them. Kernel modules were already not being used at all in OpenBSD, they are removing an unused "feature".
- ChuckMcM 12y ago
  > Are they going to build all the supported HW device > drivers all into the kernel image? Historically that was what the 'Generic' kernel was, something which would boot on any system. A typical system configuration would be to boot the generic kernel, edit the configuration file to select only those devices and features that were going to be used, config and then make that kernel. Then boot from the configured kernel from then on. There has been both a lot of research and debate about various 'microkernel' strategies where the core of the micro-kernel really only knows how to access the boot disk and load modules. Then as hardware is probed and discovered, modules to support that hardware is loaded. As a desktop machine kernel, micro-kernels allow for changes in the hardware configuration to occur fairly easily without a lot of user visible fuss. But they do leave open the vulnerability that the module system can be exploited. Server systems generally change less frequently and hardware changes beyond adding or removing a disk drive are often quite rare. Things are always trade-offs. I wonder if there is anyone doing mixed virtualization studies. Using a hypervisor that is locked down for the lower layer and then booting the "user" machine for interactive use. This is a very powerful architectural choice and was been used for decades in IBM's mainframe OS. Perhaps we'll see a consumer OS based on those principles at some point.

parfe 12y ago

34 linux users upvoted this article. OpenBSD is not Linux. The "story" is a non-event in OpenBSD world.