Hacker News

points by throwawayffffas 3 days ago | 0 comments

Nah we just all have to switch to a handfull of heavily audited memory safe unikernels.

Your http proxy and your web server don't need a shell, drivers for wifi, mail daemons, systemd, python, PHP, perl, docker, multiple users, hell it might not even need a file system.

You can ship a stripped down docket image running on a stripped down Linux distro, but that still ships the entire kernel with a huge amount of functionality you don't need that may be exploited.

[–] __d 3 days ago

I am kinda expecting the second coming of unikernels. The reduction in both attack surface and depth seems likely to be useful.

[–] mike_hearn 3 days ago

Why would unikernels fix this? They don't even attempt privilege separation at all.

[–] __d 2 days ago

Because 50m lines of code with whatever defect density is a lot more defects than a dedicated app+kernel with just the code that you need. So much of the Linux kernel is unused by any given application: why have that code loaded and runnable?

[–] muvlon 3 days ago

Exactly. Anybody deploying Linux today in scenarios where you might replace it with a unikernel is already not affected by LPE. They have a kernel running in a VM with one user and one application, in essence using Linux as a sort of bloated unikernel.