Re:The State of Linux Security
by snvzz on Friday December 30, 2016 @03:47PM
(#13287303)
> Doesn't matter if one driver can access another. I just need to read data in user home directory and I can find out everything I need.
Well, you'd need the adequate permissions to do that in the firstr place.
Or you'd have to exploit the VFS (good luck with that), the disk driver (which is hidden behind VFS, good luck with that), or some other driver which hardware is for some reason not isolated via iommu (good luck with that).
> Linux work good enough due to automated testing and amazing kernel engineers.
You definitely do not run much Linux on production, else you'd know how amazing 2016 has been, regarding kernel vulnerabilities.
Some of them were even reliably exploitable on grsec/pax patched kernels.
> Microkernals are supposed to make OSes more stable but they don't.
Except most RTOSs and anything with high assurance requirements uses microkernels.
> GNU Hurd, Mach 3
Hurd uses Mach, a pre-liedtke, old world microkernel. Not really worth pointing at it, the same way 1971 UNIX isn't representative of Linux.
> Minix - so far track record isn't good.
Minix is doing quite well at what it set out to do: Fault-tolerance.
Well, you'd need the adequate permissions to do that in the firstr place.
Or you'd have to exploit the VFS (good luck with that), the disk driver (which is hidden behind VFS, good luck with that), or some other driver which hardware is for some reason not isolated via iommu (good luck with that).
> Linux work good enough due to automated testing and amazing kernel engineers.
You definitely do not run much Linux on production, else you'd know how amazing 2016 has been, regarding kernel vulnerabilities.
Some of them were even reliably exploitable on grsec/pax patched kernels.
> Microkernals are supposed to make OSes more stable but they don't.
Except most RTOSs and anything with high assurance requirements uses microkernels.
> GNU Hurd, Mach 3
Hurd uses Mach, a pre-liedtke, old world microkernel. Not really worth pointing at it, the same way 1971 UNIX isn't representative of Linux.
> Minix - so far track record isn't good.
Minix is doing quite well at what it set out to do: Fault-tolerance.