Linus Torvalds: “Do No Harm”
Background: the &quot;kernel self protection project&quot; (KSSP) recently upstreamed the Grsecurity&#x2F;PAX reference counting implementation which prevents a certain class of security bugs from being exploited.<p>Grsecurity is a security hardening patchset for Linux that makes <i>deliberate</i> trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it&#x27;s hard to upstream it. Linus has called some of their mitigations &quot;insane&quot; before precisely for that reason. Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it&#x27;s not a trade-off everyone is happy with (including Linus).<p>Unfortunately, Grsecurity&#x2F;PAX is not (and probably won&#x27;t ever be) involved in the KSSP project, and the KSSP developers do not understand the code nearly as well as the Grsecurity team does. This lead to a situation where the new code caused a crash that they weren&#x27;t able to fix in time, so they disabled the feature in the last minute.<p>I&#x27;ve been using Grsecurity for years until they stopped making it publicly available, and I remember many bugs that were uncovered by PAX_REFCOUNT and yes, occasionally panicked the kernel where a vanilla kernel would run just fine. They usually found and fixed those within hours.<p>Grsecurity&#x2F;PAX have invented many of the modern exploitation mitigations, probably second to none. Some have even been implemented in hardware. Their expertise in building modern defenses is astonishing (their latest invention, the control flow integrity mechanism RAP, is a work of art).<p>Linux could be the most secure kernel, instead, it&#x27;s fallen way behind Windows - which has much better defenses than Linux nowadays thanks to Microsoft&#x27;s ongoing battle with rootkit writers. Go figure.<p>If the large companies who use Linux <i>really</i> want to improve kernel security, they need to work with Grsecurity and not against them. It&#x27;s beyond me how this isn&#x27;t happening already.