[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3112e2ab6a83489fa82982253bf6779005d7b375.camel@kjb.biglobe.ne.jp>
Date: Wed, 11 Nov 2026 15:46:31 +0900
From: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>
To: kernel-hardening@...ts.openwall.com,
linux-security-module@...r.kernel.org
Subject: RFC v3 Case Study Verification Results and Request for
Reconsideration
Dear ML,
Thank you for comments.
I actually tried creating the environment and running the case study,
but I realized it's quite difficult. Even just verifying this operation
was difficult for me alone, so I needed help from AI.
I would like to share the results of the RFC v3 case study verification
tests.
The test environment was Linux Mint 22.3 (based on Ubuntu 24.04 LTS)
with kernel 7.0.0-42-generic. The versions of the tools and libraries
used were as follows:
BPF LSM: enabled (bpf is present in the LSM list)
Tetragon: v1.1.0
seccomp-bpf: libseccomp 2.5.5
The target of the tests was CVE-2024-0582 (io_uring mitigation
techniques).
To get straight to the point, the assumptions we made in v3 turned out
to have many practical implementation difficulties, and I believe we
need to pause and reconsider our approach.
Specifically, the following points were identified:
1.BPF LSM-based blocking was not achievable on kernel 7.0.0 because the
io_uring-specific LSM hooks do not exist in this version. Detection is
possible, but blocking is not.
2.Tetragon v1.1.0 is incompatible with kernel 7.0.0 and failed at the
BPF object loading stage.
3.seccomp-bpf blocking was successful, but it is only effective on a
per-process basis.
4.During the tests, numerous implementation barriers were encountered,
including kernel symbol differences, missing tracepoint structures in
vmlinux.h, and bpftool virtual package issues.
Based on these results, the core claim of v3, that "it is technically
possible but not operationally scalable," was verified. However, the
effectiveness of BPF LSM and Tetragon depends heavily on the kernel and
tool versions, making practical deployment in the field difficult in
the current state.
I believe we should clarify the prerequisites and better define the
conditions for each technique before proceeding with further
discussion. I would appreciate your thoughts.
Best regards,
Nakashima Seiichi
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
