On Sun, 2026-05-03 at 07:43 +1000, Brian May wrote: > Reid Sutherland <[email protected]> writes: > > > I'm assuming any thoroughly qualified platform engineer compiles > > the > > host kernel without module support. At least, that needs to make a > > comeback, bring back applying grsec patches and make menuconfig.. > > Kernel modules here are good, not bad. If everything was compiled > into > the kernel it would be harder to solve this sort of security issue. >
Yeah but there's a series of problems here, like autoloading modules on a server that doesn't change. Thinking about the math functions, there's a good benefit in the kernel carrying common interfaces for functions they have already solved. But we need a new unprivileged layer in the kernel, like a library layer, if this is desired. Microsoft had to rework the kernel security after Crowdstrike ruined everything with that ridiculous outage. > In this case, it often just meant disabling the module that often > wasn't > even loaded. The only exception was if I tested the vulnerabilty > before > hand :-). Even then, easy to unload the module and disable it. > > But I heard some enterprise kernels came with the code compiled into > the > kernel, and these required a kernel command line option and a reboot > to > fix. > > Of course, maybe there is the argument that only the things you need > should be enabled; but this would be a lot harder for distros to keep > everyone happy. Maybe an argument for building your own custom > kernels > not relying on distro kernels. Yeah that would be it. You boot with the default kernel and then build your system specific kernel.
