Linux Kernel Defence Map – Security Hardening Concepts

[anthonyryan1]

This is by the author of the very helpful kernel-hardening-checker: https://github.com/a13xp0p0v/kernel-hardening-checker

An interesting tool for analyzing your personal kernel config file and pointing out areas for security improvement. It's more comprehensive than KSPP (https://kspp.github.io/) but sometimes goes a little too far, suggesting disabling kernel features you may actively use.

Definitely worth trying!

[egberts1]

This is the way.

Close all avenues, then only open what you exactly need.

[nine_k]

The number of defenses is pretty impressive. The number of out-of-tree and commercial defenses is also impressive. The amount dedicated to specifics of C (UB, bounds checks, use-after-free) is relatively small.

It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features.

[zie]

> It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features.

I'm not sure that would be a very fair comparison. A lot of OpenBSD security comes from just skipping giant swaths of stuff. Advanced filesystems are non-existent, Bluetooth is non-existent, etc.

I haven't done a count lately, but I would guess the Linux Kernel alone is larger than the OpenBSD base system. It's simplicity is a huge security feature. Provided you don't need some of those features.

I'm not saying this as an OpenBSD hater or anything, I run OpenBSD on at least one machine.

[acje]

I find it inspiring that we are getting to where we are dealing with models that classify vulnerabilities at a systems level. However I also think we are kind of barking up the wrong three. There is IMHO something wrong with the current strategy of scaling up the von Neumann architecture. It leads to fragile software partitioning, noisy neighbors and both slow and sometimes unintended communication through shared memory. I’ve tried to lay this out in detail here https://lnkd.in/dRNSYPWC

[transpute]

Have you looked at Barrelfish (2011) from Microsoft Research and ETH Zurich?

https://www.microsoft.com/en-us/research/blog/barrelfish-exp...

> “In the next five to 10 years,” Barham predicts, “there are going to be many varieties of multicore machines. There are going to be a small number of each type of machine, and you won’t be able to afford to spend two years rewriting an operating system to work on each new machine that comes out. Trying to write the OS so it can be installed on a completely new computer it’s never seen before, measure things, and think about the best way to optimize itself on this computer—that’s quite a different approach to making an operating system for a single, specific multiprocessor.” The problem, the researchers say, stems from the use of a shared-memory kernel with data structures protected by locks. The Barrelfish project opts instead for a distributed system in which each unit communicates explicitly.

Public development stopped in March 2020, https://github.com/BarrelfishOS/barrelfish & https://barrelfish.org

[simonask]

I think your take is interesting, but your article does not go into details with ideas about how to address these problems at the architectural level. Would you like to elaborate?

[chenhoey1211]

Really solid conceptual map — not just for kernel devs, but also useful if you're working in Rust, Zig, or any low-level system code.

Has anyone come across a similar visual breakdown for Wasm runtimes, especially around sandboxing and isolation models?

[Sponge5]

> This map describes kernel security hardening. It doesn't cover cutting attack surface.

For those wondering why SECCOMP is ommited.

[hart_russell]

Do these settings persist if I update the kernel on my ubuntu server?