Hole in Linux kernel provides root rights

Re:Hole in Linux kernel provides root rights by rbanffy on Sunday September 19, 2010 @09:12PM (#1707397)

Anyone would like to explain why stuff like this is not automatically tested? Introducing tests into the kernel source tree would actually help its development and prevent incidents like this, wouldn't it?

[ Parent | on HN ]

Re:Hole in Linux kernel provides root rights by mfukar on Monday September 20, 2010 @02:46AM (#1708035)

How would you go about testing system calls?

[ Parent | on HN ]

Re:Hole in Linux kernel provides root rights by rbanffy on Monday September 20, 2010 @09:47AM (#1708757)

Why not?

I understand device drivers cannot be easily tested (unless we write accurate hardware simulators, which can be done with a lot of effort), and the same happens with time-critical stuff (that could be solved with even more hardware emulation) but this kind of stuff (checking if a known exploit fails) could and should be tested in automated fashion.

Not everything can be tested reliably and automatically, but what can, should.

[ Parent | on HN ]

Re:Hole in Linux kernel provides root rights by mfukar on Monday September 20, 2010 @11:41AM (#1709209)

Oh, you're talking about regression testing. While you have a point, I'd like to point out a recent vulnerability [1] that would likely fail many a test for two reasons:

- The bug is not concrete. It's not entirely in the kernel, and it's not entirely in userspace.

- The developers have a poor understanding of the bug. The current "fix" only mitigates the problem. There are system configurations where it can still be exploited. There are other issues [2] that arise from large address space management that are waiting to be fixed because of this.

But I agree that regression testing for the whole kernel tree should probably be implemented. (for the various subsystems, many developers develop their own test suites)

[1] http://theinvisiblethings.blogspot.com/2010/08/skeletons-hid... [2] http://grsecurity.net/~spender/64bit_dos.c

[ Parent | on HN ]

Re:Hole in Linux kernel provides root rights by RexRollman on Monday September 20, 2010 @06:13AM (#1708315)

It's open source. We are all testers.

[ Parent | on HN ]

Re:Hole in Linux kernel provides root rights by rbanffy on Monday September 20, 2010 @09:48AM (#1708759)

That's not an excuse for not having proper automated tests in place.

[ Parent | on HN ]