[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <agidthNsti0CcGcE@donburi.himad.notcom.org>
Date: Sat, 16 May 2026 19:51:26 +0300
From: Valtteri Vuorikoski <vuori@...com.org>
To: oss-security@...ts.openwall.com
Subject: Re: Recent Kernel exploits, attack surface reduction,
example IPSEC
On Sat, May 16, 2026 at 03:05:45PM +0200, Hanno Böck wrote:
> However, there's a broader point here: I think it's common these
> days that Linux distributions install most or all kernel modules by
> default, and loading them happens automatically. Which, in many cases,
> means people are potentially affected by security flaws in features
> they never use.
> "Attack surface reduction" is widely considered to be a good security
> principle, and I wonder if we can do better here.
>
> To pick the example of IPSEC, i wonder if it wouldn't be better to
> have, e.g., a separate "linux-modules-ipsec" package that isn't
> installed by default. People who use and need IPSEC will likely know
> that they need it, and can install it separately.
>
> I'm aware this doesn't come for free, and will add increased
> complexity to kernel packaging. But think about it like this: If we had
> that separation, three of the recent kernel local root exploits would've
> been much less impactful, and wouldn't have affected most systems.
FWIW OpenWRT has had separate packaging for a long time for most driver and
protocol type kernel modules. I assume it was originally done for space-saving
reasons, but it has now become a useful feature for other reasons too. Their
strongswan package depends on the needed kmod packages, to continue with the
ipsec example.
So splitting up modules on a physical machine or VM seems fairly tractable. I
would expect that container users might be the most unhappy constituency about
this, because having all the modules available and autoloaded on demand by the
host has made deployment workflows easier for certain workloads (tunnel
protocols and proxies utilizing something like kTLS come to mind).
-Valtteri
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
