Date
1 - 2 of 2
[PATCH v2 0/2] Introduce the pkill_on_warn parameter
|
On Sat, Nov 13, 2021 at 7:14 PM Alexander Popov <alex.popov@...> wrote:
Alex, officially and formally, I cannot talk for the ELISA project (Enabling Linux In Safety Applications) by the Linux Foundation and I do not think there is anyone that can confidently do so on such a detailed technical aspect that you are raising here, and as the various participants in the ELISA Project have not really agreed on such a technical aspect being one way or the other and I would not see that happening quickly. However, I have spent quite some years on the topic on "what is the right and important topics for using Linux in safety applications"; so here are my five cents: One of the general assumptions about safety applications and safety systems is that the malfunction of a function within a system is more critical, i.e., more likely to cause harm to people, directly or indirectly, than the unavailability of the system. So, before "something potentially unexpected happens"---which can have arbitrary effects and hence effects difficult to foresee and control---, it is better to just shutdown/silence the system, i.e., design a fail-safe or fail-silent system, as the effect of shutdown is pretty easily foreseeable during the overall system design and you could think about what the overall system does, when the kernel crashes the usual way. So, that brings us to what a user would expect from the kernel in a safety-critical system: Shutdown on any event that is unexpected. Here, I currently see panic_on_warn as the closest existing feature to indicate any event that is unexpected and to shutdown the system. That requires two things for the kernel development: 1. Allow a reasonably configured kernel to boot and run with panic_on_warn set. Warnings should only be raised when something is not configured as the developers expect it or the kernel is put into a state that generally is _unexpected_ and has been exposed little to the critical thought of the developer, to testing efforts and use in other systems in the wild. Warnings should not be used for something informative, which still allows the kernel to continue running in a proper way in a generally expected environment. Up to my knowledge, there are some kernels in production that run with panic_on_warn; so, IMHO, this requirement is generally accepted (we might of course discuss the one or other use of warn) and is not too much to ask for. 2. Really ensure that the system shuts down when it hits warn and panic. That requires that the execution path for warn() and panic() is not overly complicated (stuffed with various bells and whistles). Otherwise, warn() and panic() could fail in various complex ways and potentially keep the system running, although it should be shut down. Some people in the ELISA Project looked a bit into why they believe panic() shuts down a system but I have not seen a good system analysis and argument why any third person could be convinced that panic() works under all circumstances where it is invoked or that at least, the circumstances under which panic really works is properly documented. That is a central aspect for using Linux in a reasonably-designed safety-critical system. That is possibly also relevant for security, as you might see an attacker obtain information because it was possible to "block" the kernel shutting down after invoking panic() and hence, the attacker could obtain certain information that was only possible because 1. the system got into an inconsistent state, 2. it was detected by some check leading to warn() or panic(), and 3. the system's security engineers assumed that the system must have been shutting down at that point, as panic() was invoked, and hence, this would be disallowing a lot of further operations or some specific operations that the attacker would need to trigger in that inconsistent state to obtain information. To your feature, Alex, I do not see the need to have any refined handling of killing a specific process when the kernel warns; stopping the whole system is the better and more predictable thing to do. I would prefer if systems, which have those high-integrity requirements, e.g., in a highly secure---where stopping any unintended information flow matters more than availability---or in fail-silent environments in safety systems, can use panic_on_warn. That should address your concern above of handling certain CVEs as well. In summary, I am not supporting pkill_on_warn. I would support the other points I mentioned above, i.e., a good enforced policy for use of warn() and any investigation to understand the complexity of panic() and reducing its complexity if triggered by such an investigation. Of course, the listeners and participants in the ELISA Project are very, very diverse and still on a steep learning curve, i.e., what does the kernel do, how complex are certain aspects in the kernel, and what are reasonable system designs that are in reach for certification. So, there might be some stakeholders in the ELISA Project that consider availability of a Linux system safety-critical, i.e., if the system with a Linux kernel is not available, something really bad (harmful to people) happens. I personally do not know how these stakeholders could (ever) argue the availability of a complex system with a Linux kernel, with the availability criteria and the needed confidence (evidence and required methods) for exposing anyone to such system under our current societal expectations on technical systems (you would to need show sufficient investigation of the kernel's availability for a certification), but that does not stop anyone looking into it... Those stakeholders should really speak for themselves, if they see any need for such a refined control of "something unexpected happens" (an invocation of warn) and more generally what features from the kernel are needed for such systems. Lukas
|
|
|
|
On Tue, Nov 16, 2021 at 7:37 AM Christophe Leroy
<christophe.leroy@...> wrote: Christophe, I agree with a reasonable goal that WARN() should allow users "to deal with those situations as gracefull as possible, allowing the system to continue running the best it can until a human controled action is taken." However, that makes me wonder even more: what does the system after a WARN() invocation still need to provide as properly working functionality, so that the human can take action, and how can the kernel indicate to the whole user applications that a certain functionality is not working anymore and how adaptive can those user application really be here? Making that explicit for every WARN() invocation seems to be tricky and probably also quite error-prone. So, in the end, after a WARN(), you end up running a system where you have this uncomfortable feeling of a running system where some things work and some things do not and it might be insecure (the whole system security concept is invalidated, because security features do not work, security holes are opened etc.) or other surprises happen. The panic_on_warn implements a simple policy of that "run as graceful as possible": We assume stopping the kernel is _graceful_, and we just assume that the functionality "panic shuts down the system" still works properly after any WARN() invocation. Once the system is shut down, the human can take action and switch it into some (remote) diagnostic mode for further analysis and repair. I am wondering if that policy and that assumption holds for all WARN() invocations in the kernel? I would hope that we can answer this question, which is much simpler than getting the precise answer on "what as graceful as possible actually means". Lukas
|
|
|