There's also no rewriting millions of lines of code. There are a bunch of more realistic approaches, like making compilers much safer by default, sandboxing services, partially microkerneling critical pieces of code, for example: moving network stack out of the kernel and into the userspace with proper security measures, we even already have netmap to begin the process.

Like what Criswell et al are doing with SVA-OS and CHERI team are doing with CheriBSD.

Counterexample - OpenBSD.

Even a micro-kernel won't help. Even there, you have a few "keys to the kingdom", such as compromising the HD driver (If I can write what I want, I can modify the micro-kernel how I want).

Ok Mr Tanenbaum, Linus and you already had this argument </sarcasm>

Guys...All of you are irrelevant. Doesn't matter if one driver can access another. I just need to read data in user home directory and I can find out everything I need.

Or go to random website look for .Git folders, recreate directory structure from object file, get MySQL passwords and steal user data (I'm not responsible for anyone using my comment for illegal purposes)

Microkernals are supposed to make OSes more stable but they don't. Linux work good enough due to automated testing and amazing kernel engineers.

GNU Hurd, Mach 3, Minix - so far track record isn't good. Stop flamewaring and fire up vim. Write a microkernals if you think you can do a better job

> Doesn't matter if one driver can access another. I just need to read data in user home directory and I can find out everything I need.

Well, you'd need the adequate permissions to do that in the firstr place.

Or you'd have to exploit the VFS (good luck with that), the disk driver (which is hidden behind VFS, good luck with that), or some other driver which hardware is for some reason not isolated via iommu (good luck with that).

> Linux work good enough due to automated testing and amazing kernel engineers.

You definitely do not run much Linux on production, else you'd know how amazing 2016 has been, regarding kernel vulnerabilities.

Some of them were even reliably exploitable on grsec/pax patched kernels.

> Microkernals are supposed to make OSes more stable but they don't.

Except most RTOSs and anything with high assurance requirements uses microkernels.

> GNU Hurd, Mach 3

Hurd uses Mach, a pre-liedtke, old world microkernel. Not really worth pointing at it, the same way 1971 UNIX isn't representative of Linux.

> Minix - so far track record isn't good.

Minix is doing quite well at what it set out to do: Fault-tolerance.

And looking at embedded OSes, L4, sandboxing in Apple, Google and Microsoft OSes, the future direction is quite clear.

Does Apple run on a MicroKernel? Microsoft? Google definitely doesn't (it runs on linux).

The problems they solve are orthogonal to kernel issues.

Sandboxing thwarts userspace attacks (any program I install has access to my userspace). Microkernels solve kernel side attacks.

The real irony is that Android might as well run on a microkernel, considering no OEM has any intention of ever making their firmware work on anyone else's hardware. Everyone's ROMs would be more or less just as incompatible as they are now, but at least they'd be faster and much more secure at the kernel level.

>but at least they'd be faster

The problem with microkernal's isn't compatibility, it's speed.

QNX, Genode and L4 have solved that problem longtime ago.

The problems with microkernels are mostly urban legends.

So why can't hurd get its act together?

Because they're still using Mach, and most capable contributors moved on to microkernel-based projects that actually aren't hopeless.

Lack of volunteers.

Lack of resources and manpower.

Google's working on Fuchsia. This might be exactly their plan.

Yes all of them do depend on some form on microkernels.

It is called L4 and is responsible for the baseband communications and secure enclave.

https://en.wikipedia.org/wiki/L4_microkernel_family#Commerci...

Apple uses XNU which is a hybrid kernel based on the Mach 3 microkernel

https://en.wikipedia.org/wiki/XNU

OSX is effectively a microkernel in name only, its a microkernel with a single monolithic UNIX kernel client, and has virtually none of the advantages of a real microkernel setup with multiple clients sharing tasks.

L4Linux on Genode. Problem solved.

Integrity PC, LynxSecure, and Turaya Desktop being commercial equivalents being sold now. Genode a dual-licensed work in progress. Minix 3 did it for availability with NetBSD layer.

Definitely proven to be doable but just few doing it.