OS hacking: Unmapping kernel functions after initialization

[eXNoah]

Seriously one of the best channels on youtube. Thanks for the fantastic content!

[Extys]

Applying this technique to user space would truly be next level stuff!

[winfrk]

I've never seen someone so happy about throwing stuff out :D
"cpu_setup()? Who needs it?!" "CPU detection? - mhhhhmmmm!"

Truly a great video about a cool concept.

[dzenanjupic]

@Andreas Kling, you probably already know that and don't use it by purpose, but just in case:
CLion comes with a handy commit dialogue. You can just hit `Ctrl + K` to open it, and it will show you all the changed and unversioned files. You can also see the difference to before, just commit individual changes, or tell CLion to reformat your code or check todos before committing. `Ctrl + Shift + K` will then push the changes. (When I remember correctly, they changed the default dialogue to a non-modal window. I prefer the modal one, since it has more features `Settings > Version Control > Commit > [ ] Use non-modal commit interface` )

Btw. you make amazing videos! I learn a lot from them, and it's really inspiring to watch you code.

[RegiJatekokMagazin]

Im writing my own Kernel / OS too, and I appreciate your work, I have to find more ideas about this Security area too ... but my kernel main design principle is to generalize execution on any architecture / being portable / and have a component / database based approach in the whole system for the future ...

[wawamake]

guy"s living the dream. i've settled only for a posix-complient compiler

[BGroothedde]

This video is super interesting, thanks for sharing Andreas!

[DJohn]

Hello Andreas, This is nice and fun. I can imagine it's fun for you (your team) to hear people saying that these security features play against them. I think it would also a great idea to make a version of the OS without these low level security features. This will gif you a littlest more work because you will need to patch/maintain two "stable" branches but will potentially make you OS more secure because you get more information about the security problems if someone manage to turn off this low level features. It makes you lets say an additional security layer. Like Apple (sorry for mentioning them :) ) does with tier a devices, they sent them to registraties security specialists with debug features enabled which make these device more vulnerable for security threads.

[thislooksfun]

Would it not be a good idea to integrate NEVER_INLINE into the UNMAP_AFTER_INIT macro? It feels like that would eliminate the chance that an inalienable function is marked UAI.

[mariocampos]

This is such a brilliant idea. It makes you wonder if Linux or the BSDs do this as well. And if not, why?

[MostafaGoher]

boot.s sounded like 'boot that a##' :D, nice video 👍👍

[johnnic]

This makes me wonder if there's some tool or CLion extension which would be able to tell you if a function was only called from functions marked with this new macro. Would make finding usages of code that shouldn't be called much easier

[christiankuhl]

Excellent videos! I really like your clear style! One question regarding the freed pages though: the unmapped KiB do not really correlate to freed memory (compared to the kernel version before this video), do they, since you forced the UNMAP_AFTER_INIT functions into separate pages in the first place? Anyway, I feel that user space programs could benefit from this technique, too, if only to reduce attack surface...

[jonnoMoto]

I also wondered if that could be used in userland seeing that in c++ there is the once_flag. Although, do you want to kernel panic or just nop?

[ForLoveOfCats]

I'm curious how such security measures that prevent executing userspace memory will affect software which relies on a JIT of some kind? It seems with my limited knowledge that it rules them out entirely, is that the case?

[MarekKnapek]

I'm not sure whether you make the unmapped area available for regular allocation. If yes, I think you have problem printing the error message about accessing the unmap-after-init section of memory. Because that section no longer exists and is reused for normal allocation. Please correct me if I'm wrong or if I misunderstood something.

[nonefvnfvnjnjnjevjenjvonej]

What keyboard do you use? Love your videos.