linux-hardening - Reducing runtime complexity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y4kJ4Hw0DVfy7S37@mailbox.org>
Date:   Thu, 1 Dec 2022 21:09:04 +0100
From:   Stefan Bavendiek <stefan.bavendiek@...lbox.org>
To:     kernel-hardening@...ts.openwall.com
Cc:     linux-hardening@...r.kernel.org
Subject: Reducing runtime complexity

Some time ago I wrote a thesis about complexity in the Linux kernel and how to reduce it in order to limit the attack surface[1].
While the results are unlikely to bring news to the audience here, it did indicate some possible ways to avoid exposing optional kernel features when they are not needed.
The basic idea would be to either build or configure parts of the kernel after or during the installation on a specific host.

Distributions are commonly shipping the kernel as one large binary that includes support for nearly every hardware driver and optional feature, but the end user will normally use very little of this.
In comparison, a custom kernel build for a particular device and use case, would be significantly smaller. While the reduced complexity won't be directly linked with reduction in attack surface, from my understanding the difference would make a relevant impact.

The question I keep wondering about is how feasible this is for general purpose distributions to have the kernel "rebuild" in this way when it is installed on a particular machine.

- Stefan

[1] https://doi.org/10.13140/RG.2.2.29943.70561

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)