Re: Reducing runtime complexity

Pawan Gupta <[email protected]> Thu, 1 Dec 2022 13:14:29 -0800

Newsgroups	com.openwall.lists.kernel-hardening,org.kernel.vger.linux-hardening
Message-ID	<20221201211429.venqtlzegdbdc7et@desk>

On Thu, Dec 01, 2022 at 09:09:04PM +0100, Stefan Bavendiek wrote:
>Some time ago I wrote a thesis about complexity in the Linux kernel and
>how to reduce it in order to limit the attack surface[1]. While the
>results are unlikely to bring news to the audience here, it did
>indicate some possible ways to avoid exposing optional kernel features
>when they are not needed. The basic idea would be to either build or
>configure parts of the kernel after or during the installation on a
>specific host. Distributions are commonly shipping the kernel as one
>large binary that includes support for nearly every hardware driver and
>optional feature

Is this really true? Most drivers are built as loadable modules and are
only loaded when the hardware is present.

Are you suggesting to configure-out the modules that are always static?
This sounds like an embedded system build.

signature.asc (application/pgp-signature, 833 B)