Reducing runtime complexity

Reducing runtime complexity

[Stefan Bavendiek]

[-- Attachment #1: Type: text/plain, Size: 1132 bytes --]

Some time ago I wrote a thesis about complexity in the Linux kernel and how to reduce it in order to limit the attack surface[1].
While the results are unlikely to bring news to the audience here, it did indicate some possible ways to avoid exposing optional kernel features when they are not needed.
The basic idea would be to either build or configure parts of the kernel after or during the installation on a specific host.

Distributions are commonly shipping the kernel as one large binary that includes support for nearly every hardware driver and optional feature, but the end user will normally use very little of this.
In comparison, a custom kernel build for a particular device and use case, would be significantly smaller. While the reduced complexity won't be directly linked with reduction in attack surface, from my understanding the difference would make a relevant impact.

The question I keep wondering about is how feasible this is for general purpose distributions to have the kernel "rebuild" in this way when it is installed on a particular machine.

- Stefan


[1] https://doi.org/10.13140/RG.2.2.29943.70561

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Reducing runtime complexity

[Pawan Gupta]

[-- Attachment #1: Type: text/plain, Size: 876 bytes --]

On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
>Some time ago I wrote a thesis about complexity in the Linux kernel and
>how to reduce it in order to limit the attack surface[1]. While the
>results are unlikely to bring news to the audience here, it did
>indicate some possible ways to avoid exposing optional kernel features
>when they are not needed. The basic idea would be to either build or
>configure parts of the kernel after or during the installation on a
>specific host. Distributions are commonly shipping the kernel as one
>large binary that includes support for nearly every hardware driver and
>optional feature

Is this really true? Most drivers are built as loadable modules and are
only loaded when the hardware is present.

Are you suggesting to configure-out the modules that are always static?
This sounds like an embedded system build.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Reducing runtime complexity

[Kees Cook]

On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
> Some time ago I wrote a thesis about complexity in the Linux kernel and how to reduce it in order to limit the attack surface[1].
> While the results are unlikely to bring news to the audience here, it did indicate some possible ways to avoid exposing optional kernel features when they are not needed.
> The basic idea would be to either build or configure parts of the kernel after or during the installation on a specific host.
> 
> Distributions are commonly shipping the kernel as one large binary that includes support for nearly every hardware driver and optional feature, but the end user will normally use very little of this.
> In comparison, a custom kernel build for a particular device and use case, would be significantly smaller. While the reduced complexity won't be directly linked with reduction in attack surface, from my understanding the difference would make a relevant impact.
> 
> The question I keep wondering about is how feasible this is for general purpose distributions to have the kernel "rebuild" in this way when it is installed on a particular machine.

Much of the functionality is modules, so once a system is booted and
running the expected workloads, one can set the modules_disabled sysctl
and block everything else from being loaded.

-Kees

-- 
Kees Cook

Re: Reducing runtime complexity

[Stefan Bavendiek]

[-- Attachment #1: Type: text/plain, Size: 2072 bytes --]

On Thu, Dec 01, 2022 at 03:21:37PM -0800, Kees Cook wrote:
> On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
> > Some time ago I wrote a thesis about complexity in the Linux kernel and how to reduce it in order to limit the attack surface[1].
> > While the results are unlikely to bring news to the audience here, it did indicate some possible ways to avoid exposing optional kernel features when they are not needed.
> > The basic idea would be to either build or configure parts of the kernel after or during the installation on a specific host.
> > 
> > Distributions are commonly shipping the kernel as one large binary that includes support for nearly every hardware driver and optional feature, but the end user will normally use very little of this.
> > In comparison, a custom kernel build for a particular device and use case, would be significantly smaller. While the reduced complexity won't be directly linked with reduction in attack surface, from my understanding the difference would make a relevant impact.
> > 
> > The question I keep wondering about is how feasible this is for general purpose distributions to have the kernel "rebuild" in this way when it is installed on a particular machine.
> 
> Much of the functionality is modules, so once a system is booted and
> running the expected workloads, one can set the modules_disabled sysctl
> and block everything else from being loaded.
> 
> -Kees
> 
> -- 
> Kees Cook

Disableing modules in general will prevent quite a lot of functionality that would still be expected to work, like plugging in a usb device.
One approach may be to load everything that may possibly be required in the future as well based on the use case of the specific system and then disable loading additional modules, but that does not seem like a good solution either.

Perhaps exploring embedded device deployments is an idea, but in general the idea is to ship a smaller kernel to something like Linux desktops without limiting functionality that likely to be required.

- Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Reducing runtime complexity

[Kees Cook]

On Fri, Dec 02, 2022 at 07:31:06AM +0100, Stefan Bavendiek wrote:
> On Thu, Dec 01, 2022 at 03:21:37PM -0800, Kees Cook wrote:
> > On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
> > > Some time ago I wrote a thesis about complexity in the Linux kernel and how to reduce it in order to limit the attack surface[1].
> > > While the results are unlikely to bring news to the audience here, it did indicate some possible ways to avoid exposing optional kernel features when they are not needed.
> > > The basic idea would be to either build or configure parts of the kernel after or during the installation on a specific host.
> > > 
> > > Distributions are commonly shipping the kernel as one large binary that includes support for nearly every hardware driver and optional feature, but the end user will normally use very little of this.
> > > In comparison, a custom kernel build for a particular device and use case, would be significantly smaller. While the reduced complexity won't be directly linked with reduction in attack surface, from my understanding the difference would make a relevant impact.
> > > 
> > > The question I keep wondering about is how feasible this is for general purpose distributions to have the kernel "rebuild" in this way when it is installed on a particular machine.
> > 
> > Much of the functionality is modules, so once a system is booted and
> > running the expected workloads, one can set the modules_disabled sysctl
> > and block everything else from being loaded.
> > 
> > -Kees
> > 
> > -- 
> > Kees Cook
> 
> Disableing modules in general will prevent quite a lot of functionality that would still be expected to work, like plugging in a usb device.
> One approach may be to load everything that may possibly be required in the future as well based on the use case of the specific system and then disable loading additional modules, but that does not seem like a good solution either.
> 
> Perhaps exploring embedded device deployments is an idea, but in general the idea is to ship a smaller kernel to something like Linux desktops without limiting functionality that likely to be required.

What I mean is that we already have a good middle-ground. It doesn't
need to be all (general distro) or nothing (embedded build). Once the
workload for the system is known, load the needed modules and block
everything else. i.e. set up a module alias named "disable", and then
fill /etc/modules with whatever you might want that isn't automatically
loaded at boot and end the list with "disable". I wrote this up almost
exactly 10 years ago:

https://outflux.net/blog/archives/2012/11/28/clean-module-disabling/

:)

-Kees

-- 
Kees Cook

Re: Reducing runtime complexity

[Stefan Bavendiek]

[-- Attachment #1: Type: text/plain, Size: 2971 bytes --]

On Fri, Dec 02, 2022 at 12:13:48PM -0800, Kees Cook wrote:
> On Fri, Dec 02, 2022 at 07:31:06AM +0100, Stefan Bavendiek wrote:
> > On Thu, Dec 01, 2022 at 03:21:37PM -0800, Kees Cook wrote:
> > > On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
> > > > Some time ago I wrote a thesis about complexity in the Linux kernel and how to reduce it in order to limit the attack surface[1].
> > > > While the results are unlikely to bring news to the audience here, it did indicate some possible ways to avoid exposing optional kernel features when they are not needed.
> > > > The basic idea would be to either build or configure parts of the kernel after or during the installation on a specific host.
> > > > 
> > > > Distributions are commonly shipping the kernel as one large binary that includes support for nearly every hardware driver and optional feature, but the end user will normally use very little of this.
> > > > In comparison, a custom kernel build for a particular device and use case, would be significantly smaller. While the reduced complexity won't be directly linked with reduction in attack surface, from my understanding the difference would make a relevant impact.
> > > > 
> > > > The question I keep wondering about is how feasible this is for general purpose distributions to have the kernel "rebuild" in this way when it is installed on a particular machine.
> > > 
> > > Much of the functionality is modules, so once a system is booted and
> > > running the expected workloads, one can set the modules_disabled sysctl
> > > and block everything else from being loaded.
> > > 
> > > -Kees
> > > 
> > > -- 
> > > Kees Cook
> > 
> > Disableing modules in general will prevent quite a lot of functionality that would still be expected to work, like plugging in a usb device.
> > One approach may be to load everything that may possibly be required in the future as well based on the use case of the specific system and then disable loading additional modules, but that does not seem like a good solution either.
> > 
> > Perhaps exploring embedded device deployments is an idea, but in general the idea is to ship a smaller kernel to something like Linux desktops without limiting functionality that likely to be required.
> 
> What I mean is that we already have a good middle-ground. It doesn't
> need to be all (general distro) or nothing (embedded build). Once the
> workload for the system is known, load the needed modules and block
> everything else. i.e. set up a module alias named "disable", and then
> fill /etc/modules with whatever you might want that isn't automatically
> loaded at boot and end the list with "disable". I wrote this up almost
> exactly 10 years ago:
> 
> https://outflux.net/blog/archives/2012/11/28/clean-module-disabling/
> 
> :)
> 
> -Kees
> 
> -- 
> Kees Cook

This does look quite similar to what I had in mind.
Thank you for the response.

- Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Reducing runtime complexity

[Luis Chamberlain]

On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
> Distributions are commonly shipping the kernel as one large binary
> that includes support for nearly every hardware driver and optional
> feature, but the end user will normally use very little of this.  In
> comparison, a custom kernel build for a particular device and use
> case, would be significantly smaller. While the reduced complexity
> won't be directly linked with reduction in attack surface, from my
> understanding the difference would make a relevant impact.

I looked into a similar problem back in the day when trying to vet
correctness of the Xen hypervisor when you are boooting a Xen guest
and not a KVM guest, how do we ensure that code that should not be
run should not run? Although it's a separate problem the solution
to strive to block / drop code which should not run essentially
would accomplish the same goal: prevent dead code to run.

It is *one* reason why I ended up implementing linker-tables long
ago on Linux, although this didn't get merged. The idea there was
that *eventually*, once you have mapped code into a section and
you are certain it should not not via ELF sections, you could just
drop / NX the code you don't need at runtime.

It turns out obviously Linux is not the only place where we could
benefit from this sort of work and when I reviewed the prospects
on the Qemu with Alexander Graf we instead persued the idea of a
GCC compiler multiverse support, and thanks to some researchers
that is now real code.

All these things are related, and so I started long ago jotting
some of the ideas here:

https://kernelnewbies.org/KernelProjects/kernel-sandboxing

Since linker tables didn't get merged I didn't follow up though but
in theory a lot of NX / free'ing dead code shoudl be possible for large
parts of text dynamically at runtime.

  Luis