[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <X9UjVOuTgwuQwfFk@mailbox.org>
Date: Sat, 12 Dec 2020 21:08:52 +0100
From: stefan.bavendiek@...lbox.org
To: kernel-hardening@...ts.openwall.com
Cc: linux-hardening@...r.kernel.org
Subject: Kernel complexity
Hi,
first of all, thanks to everyone here for this awesome project and the work you do.
Personally I am interested in Linux Kernel Security and especially features supporting attack surface reduction. In the past I did some work on sandboxing features like seccomp support in user space applications. I have been rather hesitant to get involved here, since I am not a full time developer and certainly not an expert in C programming.
However I am currently doing a research project that aims to identify risk areas in the kernel by measuring code complexity metrics and assuming this might help this project, I would like to ask for some feedback in case this work can actually help with this project.
My approach is basically to take a look at the different system calls and measure the complexity of the code involved in their execution. Since code complexity has already been found to have a strong correlation with the probability of existing vulnerabilities, this might indicate kernel areas that need a closer look.
Additionally the functionality of the syscall will also be considered for a final risk score, although most of the work for this part has already been done in [1].
The objective is to create a risk score matrix for linux syscalls that consists of the functionality risk according to [1], times the measured complexity.
This will (hopefully) be helpful to identify risk areas in the kernel and provide user space developers with an measurement that can help design secure software and sandboxing features.
One major aspect I am still not sure about is the challenges regarding the dynamic measure of code path execution. While it is possible to measure the cyclomatic complexity of the kernel code with existing tools, I am not sure how much value the results would have, given that this does not include the dynamic code path behind each syscall. I was thinking of using ftrace to follow and measure the execution path. Any feedback and advise on this for this would be appreciated.
-- Stefan
Ref.
[1] Massimo Bernaschi, Emanuele Gabrielli, and Luigi Mancini. Remus: A security-enhanced Operating system (2002)
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
