Re: [Ksummit-discuss] [TOPIC] kernel hardening / self-protection / whatever

[ebiederm@xmission.com (Eric W. Biederman)]

Andy Lutomirski <luto@amacapital.net> writes:

> Are there useful things to discuss in person about hardening?  (I
> don't want to bikeshed about the name at the kernel summit if we can
> possibly avoid it.)
>
> Plausible sub-topics include:
>
>  - "USERCOPY" hardening
>
>  - Virtually mapped stacks (I'm hoping to have that in for x86 before
> kernel summit...)
>
>  - Refcount
>
> I don't how much of this really needs an in-person meeting, but maybe
> some if it would benefit.

Given the history of the previous work on which much of this kernel
hardening work is inspired, I think it makes some sense to discuss what
is needed to get various features ready for mainline.

Many kernel hardening features are perceived as having downsides affect
performance or code maintainability.  Which quite frankly is a security
issue of another flavor because if something does not work well, and or
is not maintainable after a while it won't get used.  Rarely are we in
the situation where defense against attack is the most important thing
that people who are deploying linux are worried about.

Eric