Linux Kernel Security Done Right (Google Security Blog) [LWN.net]

Linux Kernel Security Done Right (Google Security Blog)

Posted Aug 4, 2021 13:08 UTC (Wed) by pmenzel (subscriber, #113811)
In reply to: Linux Kernel Security Done Right (Google Security Blog) by smoogen
Parent article: Linux Kernel Security Done Right (Google Security Blog)

> The other area is where software is a complicated beast. You run version X.Y of the kernel and the software works (say your payroll system or your manufacturing looms). You run version X.(Y+m) of the kernel and something starts breaking. Then you play a long game of blame between the software you need to work and the kernel about whose fault it is.

Actually, Linux’ no-regression rule “We do not break userspace.“ is very clear, making it Linux’ problem.

to post comments

Linux Kernel Security Done Right (Google Security Blog)

Posted Aug 4, 2021 14:06 UTC (Wed) by smoogen (subscriber, #97) [Link]

Yes after you have spent time and effort proving that it is actually a regression versus bad code. It is very rarely a one-and-done email, but a lot of work getting the evidence together that it is broken versus a buggy compiler, library set, or a dozen other things it actually could also be. That is time and energy most end companies have no plans to spend time on so will just either stick to a working known state or pay someone else to do that work for them while keeping them on a working known state.

Linux Kernel Security Done Right (Google Security Blog)

Posted Aug 10, 2021 15:01 UTC (Tue) by geert (subscriber, #98403) [Link]

And running "git bisect" to find the Linux version that broke is usually much easier than trying to bisect a complex userspace stack.