Re: [TECH TOPIC] Improving kernel security & integrity by generalizing ad-hoc safety mechanisms

["Theodore Tso" <tytso@mit.edu>]

Looking at some of the videos which you cited, and your description,
what the kernel safety effort reminds me is the PREEMPT_RT patches[1],
so the path to upstream that was followed by the PREEMPT_RT patches
might be instructive.

[1] https://en.wikipedia.org/wiki/PREEMPT_RT

There were plenty of people who were people doing soft realtime
without needing PREEMPT_RT, but if what your project required
something stronger --- hard realtime guarantees --- then you needed
the PREEMPT_RT patch set[2].

[2] https://www.socallinuxexpo.org/scale7x/sites/scale7x.socallinuxexpo.org/files/Bryan-che-IntroToRealtime-Scale2009.pdf

I was quite familiar with PREEMPT_RT, since I led the team at IBM
which productized the PREEMPT_RT patches for use by the US Navy's
DD(G)-1000 Zumwalt class destroyer.  Also involved included John
Stultz and Darren Hart, who are still involved with Linux Kernel
development, and we got an IBM Systems Journal publication out of
it[3].

[3] https://www.researchgate.net/publication/220354037_Real-time_Linux_in_real_time

The path to upstream took place over many, many years, and involved
individual features that were useful not just for PREEMPT_RT patch
set, but also for other use cases.  For example, Futexes came out of
the real-time linux patchset.

So that's what I would recommend.  You will need to have a business
case to justify the huge amount of work to (a) implement Linux with
your safety certification requirements, and (b) get that work
upstream.  Since the company(s) funding the work will need to be able
to business income to justify continuing to underwrite your work,
having an out-of-tree patch set is going to be necessary.  There's no
getting around that.

Along the way, if you can find that various features in your
out-of-tree patchset can be useful for solving multiple problems
(which was the case with futexes) you can get those features lifted
out and upstreamed, thus reducing the size of the out-of-tree patch
set, and reducing your work to maintain that patch set.

Cheers,

					- Ted