Re: [TECH TOPIC] Improving kernel security & integrity by generalizing ad-hoc safety mechanisms

["Theodore Tso" <tytso@mit.edu>]

On Tue, Sep 08, 2026 at 04:52:13PM -0500, igor.stoppa@gmail.com wrote:
> Presently, if a new patch introduces either a vulnerability,
> or a regression in either functionality or performance,
> it gets rejected or at least it must be fixed accordingly.
> 
> We would need the safety-qualification criteria to be added to the list of
> properties measured and preserved across releases.

So perhaps you need to start with everything out-of-tree, and when
natural changes upstream changes, you can send patches upstream to
"fix" the issue, and we can see how annoyed everyone gets.

Your claim that it's not going to be draconian, but I think you need
to demonstrate whether or not this is actually the case.  Let's see
how much cooperation you will need from the various subsystems, and
whether it's going to involve a performance tax.  (And if there is a
performance tax, how bad is it going to be.)

Hint: if there needs to be a performance tax, it should only be paid
for those systems that care about the safety certification.  Maybe for
"safety certified" systems, people will be willing to pay a 20%
performance tax.  But everyone else.... probably not.

						- Ted