Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maestro: A Linux-compatible kernel in Rust

blog.lenot.re

Post reply on HN
Print view View original

31–40 of 380 posts

Re: Maestro: A Linux-compatible kernel in Rust

#31

Post by insanitybit »

progval wrote: post #23
FpUser wrote: post #16

Earlier quoted context omitted.

Does the fact that docker runs as a root have something to do with it?

Yes, but even rootless containers rely on user namespaces, which are a recurring source of privilege escalation vulnerabilities in Linux.

The issue of root vs rootless is unrelated to escaping the container. User namespaces lead to privescs because attackers who can enter a namespace and become the root within that namespace have access to kernel functionality that is far less hardened (because upstream has never considered root->kernel to be a privesc and, of course, most people focus on unprivileged user -> kernel privesc). The daemon running as root doesn't change anything there

Re: Maestro: A Linux-compatible kernel in Rust

#32

Post by scoot »

OscarCunningham wrote: post #12
scoot wrote: post #10

Earlier quoted context omitted.

> a docker container can't be relied upon to contain arbitrary malware "to not contain"? Edit to contain (ahem!) the downvotes: I was genuinely confused by the ambiguous use of "contain", but comments below cleared that up.

They're using 'contain' to mean 'keep isolated'. If you put some malware in a docker container, you can't rely on docker to keep the rest of your system safe.

Got it, thanks.

Re: Maestro: A Linux-compatible kernel in Rust

#33

Post by insanitybit »

FpUser wrote: post #16
OscarCunningham wrote: post #12

Earlier quoted context omitted.

They're using 'contain' to mean 'keep isolated'. If you put some malware in a docker container, you can't rely on docker to keep the rest of your system safe.

Does the fact that docker runs as a root have something to do with it?

No, it's because the malware would have direct access to the (privileged) Linux Kernel via system calls.

Re: Maestro: A Linux-compatible kernel in Rust

#35

Post by insanitybit »

GuB-42 wrote: post #20
insanitybit wrote: post #6

A memory safe linux kernel would be a fairly incredible thing. If you could snap your fingers and have it, the wins would be huge. Consider that right now a docker container can't be relied upon to contain arbitrary malware, exactly because the Linux kernel has so many security issues and they're exposed to containers. The reason why a VM like Firecracker is so much safer is that it removes the kernel as the primary…

More like memory safer. A kernel necessarily has a lot of unsafe parts. See: https://github.com/search?q=repo%3Allenotre%2Fmaestro+unsafe... Rust is not a magic bullet, it just reduces the attack surface by isolating the unsafe parts. Another way to reduce the attack surface would be to use a microkernel architecture, it has a cost though.

Practically speaking, even with `unsafe` the exploitability of rust programs is extremely difficult. With modern mitigation techniques it is required that you be able to chain multiple vulnerabilities and primitives together in order to actually reliably exploit software.

Bug density from `unsafe` is so low in Rust programs that it's just radically more difficult.

My company (not me, Chompie did the work, all credit to her for it) took a known bug, which was super high potential (write arbitrary data to the host's memory), and found it extremely difficult to exploit (we were unable to): https://chompie.rip/Blog+Posts/Attacking+Firecracker+-+AWS'+...

Ultimately there were guard pages where we wanted to write and it would have taken other vulnerabilities to actually get a working POC.

Exploitation of Rust programs is just flat out really, really hard.

Re: Maestro: A Linux-compatible kernel in Rust

#36

Post by insanitybit »

cmrdporcupine wrote: post #22
insanitybit wrote: post #6

A memory safe linux kernel would be a fairly incredible thing. If you could snap your fingers and have it, the wins would be huge. Consider that right now a docker container can't be relied upon to contain arbitrary malware, exactly because the Linux kernel has so many security issues and they're exposed to containers. The reason why a VM like Firecracker is so much safer is that it removes the kernel as the primary…

I like Rust and work in it fulltime, and like its memory-safety aspects but I think it's a bit of a stretch to be able to claim memory safety guarantees of any kind when we're talking about low-level code like a kernel. Because in reality, the kernel will have to do all sorts of "unsafe" things even just to provide for basic memory management services for itself and applications, or for interacting with hardware. You…

I've responded to the central point of "there will still be 'unsafe'" here: https://news.ycombinator.com/item?id=38853040

Re: Maestro: A Linux-compatible kernel in Rust

#37

Post by dark-star »

What a cool little project. It's astonishing how far this can boot with less than a third of the syscalls of Linux implemented.

However, my guess is that the ones that are missing are the more complicated ones. The TTY layer, for example, looks rather basic at the moment. Getting this right will probably be a lot of work.

So don't hold your breath for Maestro running your Linux applications in the next 3 years or so (even without taking into account all the thousands of drivers that Linux has)

Re: Maestro: A Linux-compatible kernel in Rust

#38

Post by Karellen »

ahmedfromtunis wrote: post #24
rhabarba wrote: post #15

Earlier quoted context omitted.

People who want stable interfaces should not touch anything Linux with a ten-foot pole.

Care to elaborate on this? I clearly understand nothing of this, but it always felt confused about it. Why won't Linux aim for ABI stability? Wouldn't that be a win for everyone involved?

https://www.kernel.org/doc/Documentation/process/stable-api-...

Re: Maestro: A Linux-compatible kernel in Rust

#39

Post by insanitybit »

K0nserv wrote: post #11
insanitybit wrote: post #6

A memory safe linux kernel would be a fairly incredible thing. If you could snap your fingers and have it, the wins would be huge. Consider that right now a docker container can't be relied upon to contain arbitrary malware, exactly because the Linux kernel has so many security issues and they're exposed to containers. The reason why a VM like Firecracker is so much safer is that it removes the kernel as the primary…

I largely agree, but this seems quite unfair to Linux. > But damn, if Linux had been built with safety in mind security would be a lot simpler. Being able to trust the kernel would be so nice. For its time, it was built with safety in mind, we can't hold it to a standard that wasn't prevalent until ~20 years later

I don't think it's that unfair, but I don't want to get into a whole thing about it, people get really upset about criticisms of the Linux kernel in my experience and I'm not looking to start my morning off with that conversation.

We can agree that C was definitely the language to be doing these things in and I don't blame Linus for choosing it.

My point wasn't to shit on Linux for its decisions, it was to think about a hypothetical world where safety built in from the start.

Re: Maestro: A Linux-compatible kernel in Rust

#40

Post by zelphirkalt »

cmrdporcupine wrote: post #14

[flagged]

Good that I did a CTRL+F before posting.

It indeed seems to be a trend to try and supplant GPL software that has served well for decades with hip and trendy probably safer software, that meeeerely has a small catch ... MIT license. I wonder how these projects even attract enough people to be developed. Especially developers of a kernel should be aware of the license side of things, that has protected us all.

Post reply on HN