Re: [Ksummit-discuss] [TECH TOPIC] Kernel Hardening

[Kees Cook <keescook@chromium.org>]

On Mon, Aug 24, 2015 at 1:17 PM, James Morris <jmorris@namei.org> wrote:
> On Mon, 24 Aug 2015, James Bottomley wrote:
>
>> Um, forgive me for being dense, but doesn't fixing the flaws stop their
>> exploitation?  In any event, Hardening means "reducing the attack
>> surface" and that encompasses both active and passive means (including
>> actual bug fixing).
>
> Hardening is mitigating those flaws.  You'll never find every flaw, but
> you can mitigate against entire classes of flaws being exploited.
>
>> >  The
>> > hardening the kernel needs is about taking away exploitation tools,
>> > not killing bugs. (Though killing bugs is still great.)
>>
>> It's both.  One of the old standards for attacking C code was buffer
>> overruns.  Remove those via detection tools and you reduce the attack
>> surface.
>
> In this case, we're specifically talking about hardening the kernel to
> mitigate exploitation of flaws.  Kernel self-protection may be a better
> term (and recently surfaced in an NSA presentation at LSS: p.23 of
>
> http://kernsec.org/files/lss2015/lss2015_selinuxinandroidlollipopandm_smalley.pdf

Yup. Using "kernel self-protection" cuts right to the point. I'm in
debt to Stephen for finding the right marketing term for "kernel
memory corruption vulnerability exploit mitigation". :)

-Kees

-- 
Kees Cook
Chrome OS Security