[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5839c90b7f964332482bcaf7eb5e9b77045c7d32.camel@kjb.biglobe.ne.jp>
Date: Sat, 07 Nov 2026 07:33:38 +0900
From: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>
To: Boris Lukashev <blukashev@...pervictus.com>
Cc: Greg KH <gregkh@...uxfoundation.org>,
kernel-hardening@...ts.openwall.com, mic@...ikod.net, paul@...l-moore.com
Subject: Re: [RFC idea] Kernel API Firewall (kaf): subsystem-level attack
surface reduction for the post-AI-CVE era
> @Nakashima Seiichi: To be fair it's actually "pick a better kernel"
> such as
> one with a security model starting at the execution and MMU layers
> since
> the fundamental problem with doing this at higher-levels comes down
> to
> mutable, type-confused, and improperly accessible memory (on-stack or
> via
> alloc) atop which the rest of what you describe has to be built.
> Castles
> built on sand with the added twist of ML tech adding grandfather
> worms
> straight from Dune.
>
> @Greg KH: there is no practical choice for using anything but what's
> prescribed by the vendor and contractually supported in the
> commercial
> world (further complicated by binary blobs/device trees/intellectual
> property concerns/etc). You cant ask the hotel to change the kiosk
> distribution to a safer one in order to check you in despite them
> having
> your PII and payment data running through it any more than the rest
> of us
> despite your undeniable awareness of the threat involved. It would be
> far
> more realistic and practical for the Linux Foundation to assign its
> seasoned talent to work on downstream distributions of economic
> relevance
> to its member entities than to swap out the OS' in the clustered
> engine of
> today's economy.
>
> -Boris
>
Thank you, Greg KH and Boris Lukashev, for your comments.
I am aware of options such as using the latest kernel or employing
tools like LivePatch. I also understand that programs execute in memory
and that those memory regions can be configured for various purposes.
In our actual production environment, we have a large number of virtual
machines running across many physical hosts, with numerous individual
applications operating on top of them. Simply applying kernel patches
in such an environment is a major undertaking.
My approach is straightforward: we handle network security using `ufw`
and web application security via a WAF. It occurred to me that if we
could use a "KAF" (Kernel API Firewall), we might be able to manage the
process of addressing and applying fixes in a more planned and
systematic way.
That said, I am not sure how difficult it would be to actually
implement such a KAF. I shared this idea simply because I thought it
could be a valuable solution if it were feasible.That is all.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
