From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
To: Stefan Bavendiek <stefan.bavendiek@mailbox.org>
Cc: kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org
Subject: Re: Reducing runtime complexity
Date: Thu, 1 Dec 2022 13:14:29 -0800 [thread overview]
Message-ID: <20221201211429.venqtlzegdbdc7et@desk> (raw)
In-Reply-To: <Y4kJ4Hw0DVfy7S37@mailbox.org>
[-- Attachment #1: Type: text/plain, Size: 876 bytes --]
On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
>Some time ago I wrote a thesis about complexity in the Linux kernel and
>how to reduce it in order to limit the attack surface[1]. While the
>results are unlikely to bring news to the audience here, it did
>indicate some possible ways to avoid exposing optional kernel features
>when they are not needed. The basic idea would be to either build or
>configure parts of the kernel after or during the installation on a
>specific host. Distributions are commonly shipping the kernel as one
>large binary that includes support for nearly every hardware driver and
>optional feature
Is this really true? Most drivers are built as loadable modules and are
only loaded when the hardware is present.
Are you suggesting to configure-out the modules that are always static?
This sounds like an embedded system build.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2022-12-01 21:35 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-01 20:09 Reducing runtime complexity Stefan Bavendiek
2022-12-01 21:14 ` Pawan Gupta [this message]
2022-12-01 23:21 ` Kees Cook
2022-12-02 6:31 ` Stefan Bavendiek
2022-12-02 20:13 ` Kees Cook
2022-12-03 8:51 ` Stefan Bavendiek
2022-12-06 2:20 ` Luis Chamberlain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221201211429.venqtlzegdbdc7et@desk \
--to=pawan.kumar.gupta@linux.intel.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-hardening@vger.kernel.org \
--cc=stefan.bavendiek@mailbox.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.