Kernel Self-Protection Project

### Overview In this Kernel Self-Protection Project (KSPP) update, Kees Cook explores the security mindset and ongoing engineering efforts required to defend the Linux kernel from exploitation. Emphasizing that upstream bug fixing alone cannot solve security issues due to long flaw lifetimes (averaging around 5.5 years) and slow downstream vendor adoption (e.g., millions of Android devices still running older kernels like 4.14 and 4.19), Cook argues that development must focus on eliminating entire bug classes and dismantling exploitation techniques rather than playing "whack-a-mole."

### Key Topics - **Flaw Lifetimes and Attacker Motivation**: Vulnerabilities persist in the kernel for years before discovery. Attackers monitor commits and discover zero-days long before defenders, making bug-fixing alone insufficient. - **Design for Failure**: Drawing an analogy from Konstantin Ryabitsev comparing Linux development to the 1960s US auto industry, Cook stresses that the kernel must be designed to fail safely when malicious manipulation occurs. - **Killing Bug Classes & Robustness**: Removing problematic language features and unsafe patterns prevents bugs from being reintroduced and improves overall kernel stability. - **Language Evolution and Rust**: While C provides low-level control, its lack of safety features makes it error-prone. Cook advocates "meeting in the middle" by stripping dangerous features from C while gradually introducing Rust for memory-safe drivers and subsystems.

### Technical Details Cook walks through two years of hardening work across Linux kernel releases (5.3 through 5.16): - **Memory & Allocation Protections**: Introduction of `init_on_alloc=1` for heap zero-initialization, Clang stack variable auto-initialization, KASAN support expansion (vmap memory, arm32, hardware tag-based MTE on arm64), KFENCE lightweight memory error detection, and removal of `dev/kmem`. - **Access Control & Sandboxing**: Upstreaming of the Landlock LSM, BPF LSM integration, Lockdown LSM (confidentiality and integrity modes), `memfd_secret`, and constant-time seccomp bitmaps with file descriptor injection capabilities. - **Exploit Mitigation & Architecture Features**: Arm64 Pointer Authentication (PAC), Branch Target Identification (BTI), Shadow Call Stack, and Clang Control Flow Integrity (CFI). Removal of `set_fs` across x86, RISC-V, PowerPC, MIPS, and arm64. Introduction of static calls to replace global function pointers and CR0/CR4 pinning on x86. - **Code Refactoring & Sanitizers**: Systematic replacement of zero-length and single-element arrays with flexible array structures, deprecation of `strcpy`/`strncpy` in favor of `strscpy`, UBSAN bounds checking separation, unprivileged `userfaultfd` restrictions to mitigate heap layout manipulations, and GCC 11 register zeroing on function exit.

### Takeaways Securing the kernel requires adopting Alexander Popov's motto of being "flexible and persistent." Hardening the kernel requires accepting development friction to guarantee security, actively engaging more reviewers, testers, and backporters, and replacing fragile C paradigms with safer kernel primitives and Rust.