[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20b68774-8985-40cd-bf99-5174d6475356@yuhu.biz>
Date: Fri, 6 Nov 2026 14:25:19 -0500
From: hackman@...u.biz
To: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>
Cc: Greg KH <gregkh@...uxfoundation.org>,
kernel-hardening@...ts.openwall.com, mic@...ikod.net,
paul@...l-moore.com
Subject: Re: [RFC idea] Kernel API Firewall (kaf): subsystem-level attack
surface reduction for the post-AI-CVE era
The users can also use the livepatch kernel infrastructure for rapid patching.
A lot of these issues are solved with small and not very complex patches, that do come quite fast with the release of the CVEs. Converting a patch to a live patch is not that hard these days.
So the users(admins) actually have more than they need to protect them self.
On the other hand, if they want to directly disable certain kernel subsystems, they can build their custom kernel by basing it on the distro kernel they currently use.
So my argument here is that these knobs that you want to add to the kernel are already there. Just there is no runtime configuration for all of them, but there is build configuration for them.
Marian
Nov 6, 2026 2:07:59 p.m. Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>:
>
>>
>> Pick a better distro. Seriously, if the distro you are paying for
>> isn't
>> keeping it up to date and secure, what are you paying them for?
>> Seems
>> like an odd choice to stick with them given you have a contract
>> saying
>> they need to abide by it...
>>
>> good luck!
>>
>> greg k-h
>
>
> Thank you for your comment. Given the high volume of vulnerability-
> related issues lately, I simply shared some ideas in the hope that they
> might help with improvements.
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
