Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Deblobbed kernel has security issues?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Kernel & Hardware
View previous topic :: View next topic  
Author Message
gorg86
Tux's lil' helper
Tux's lil' helper


Joined: 20 May 2011
Posts: 135

PostPosted: Tue Jun 09, 2015 8:56 am    Post subject: Deblobbed kernel has security issues? Reply with quote

Hi,

Can somebody please explain this?
Quote:
* Deblobbed kernels may not be up-to-date security-wise
* as they depend on external scripts.
* This means that it is likely to be vulnerable to recent security issues.
* For specific information on why this kernel is unsupported, please read:
* http://www.gentoo.org/proj/en/security/kernel.xml


According to that a deblobbed kernel is more of a security risk than a kernel with proprietary firmware.
That would defeat the purpose of a deblobbed kernel, or is that message total baloney?
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 7278
Location: almost Mile High in the USA

PostPosted: Tue Jun 09, 2015 3:38 pm    Post subject: Reply with quote

This is a problem with all old kernels, if there's no active maintainer, it may very well not be patched for recent security issues that pop up - not related to the blobs.

There are a lot of 'entry points' for security, the blobs tend to be hardware manufacturer entry points. But what the comment is - this is dealing with external hacker based entry points, more likely with network.
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 14386

PostPosted: Wed Jun 10, 2015 1:36 am    Post subject: Reply with quote

To elaborate on eccerr0r's point, a deblobbed old kernel is the same security risk as a blobs-included old kernel of the same version, ignoring any security bugs in the firmware. The message is because blobs-included kernels may be updated for security issues faster than a deblobbed kernel, so if you need the latest kernel release to patch some security bug, you might only be able to get that version in a blobs-included form. Eventually, the deblob maintainer will catch up and provide a matching deblobbed kernel with the security fix. That message indicates that "eventually" may be measured in days, rather than in minutes, depending on the free time of the deblob maintainer(s).
Back to top
View user's profile Send private message
as.gentoo
Guru
Guru


Joined: 07 Aug 2004
Posts: 319

PostPosted: Wed Jul 01, 2015 12:16 pm    Post subject: Reply with quote

IMO:

If the kernel is free software
https://www.kernel.org/category/faq.html wrote:
Linux kernel is released under GNU GPL version 2 and is therefore Free Software
then it's maintainers should innately provide a deblobbed kernel (including the most recent version).
Back to top
View user's profile Send private message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 304

PostPosted: Sat Jul 25, 2015 3:56 pm    Post subject: Reply with quote

What can you say about this?
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 44193
Location: 56N 3W

PostPosted: Sat Jul 25, 2015 8:22 pm    Post subject: Reply with quote

It all depends why you want a deblobbed kernel.

In practical terms, hardware that needs the binary blobs in the kernel is rare. If you have some you need its blob(s).
Then the only reason for using a deblodbed is free/open software zelotory.
Now, where do you stop ... USB devices that need closed firmware, your BIOS ...

If you can use a deblobbed kernel, you don't actually need it as you won't be using any of the blobs anyway.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 304

PostPosted: Sun Jul 26, 2015 6:49 am    Post subject: Reply with quote

Well, it's meaning 'blob-dependent security' in case using blobs. And blob-independent security is OK on hardened-sources, right?
If so, I understood now.
As for deblobbed kernels, can you use or you can't, there is interesting link.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 44193
Location: 56N 3W

PostPosted: Sun Jul 26, 2015 9:03 am    Post subject: Reply with quote

cord,

Thats an interesting read. It misses the point about CPU microcode though.

The CPU will do nothing without some microcode from somewhere. For a long time now, CPUs have emulated the Intel/AMD instruction set by using microcode.
The microcode is stored in ROM inside the CPU and loaded inte RAM (inside the CPU) for execution as a part of the CPU power up sequence
The RAM is much faster than ROM, this approach is required as the microcode is used at the core clock speed of the CPU.

The binary blob microcode distributed by CPU vendors simply replaces the microcode distributed with the CPU, inside the microcode RAM internal to the CPU.
So like it or not, you are using some version of the microcode.

A long time ago, before Intel CPUs had updatable microcode, there was a FPU microcode bug in some Intel CPUs.
Intel replaced these CPUs on request. Today, they would issue a microcode update.

I suspect the same is true for some of the other blobs.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Kernel & Hardware All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum