document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2024-12-26 21:30:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11233 from qhwdw/tr1111

Browse Source 
格雷解释内核社区如何保护 Linux
This commit is contained in:
Xingyu.Wang 2018-11-16 21:42:47 +08:00 committed by GitHub
commit e2efc49cf9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 70 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
sources/tech/20181002 Greg Kroah-Hartman Explains How the Kernel Community Is Securing Linux.md
View File

@ -1,75 +0,0 @@
Translating by qhwdw
Greg Kroah-Hartman Explains How the Kernel Community Is Securing Linux
============================================================
![](https://www.linux.com/sites/lcom/files/styles/rendered_file/public/kernel-security_0.jpg?itok=hOaTQwWV)
Kernel maintainer Greg Kroah-Hartman talks about how the kernel community is hardening Linux against vulnerabilities.[Creative Commons Zero][2]
As Linux adoption expands, it’s increasingly important for the kernel community to improve the security of the world’s most widely used technology. Security is vital not only for enterprise customers, it’s also important for consumers, as 80 percent of mobile devices are powered by Linux. In this article, Linux kernel maintainer Greg Kroah-Hartman provides a glimpse into how the kernel community deals with vulnerabilities.
### There will be bugs
![Greg Kroah-Hartman](https://www.linux.com/sites/lcom/files/styles/floated_images/public/greg-k-h.png?itok=p4fREYuj "Greg Kroah-Hartman")
Greg Kroah-Hartman[The Linux Foundation][1]
As Linus Torvalds once said, most security holes are bugs, and bugs are part of the software development process. As long as the software is being written, there will be bugs.
“A bug is a bug. We don’t know if a bug is a security bug or not. There is a famous bug that I fixed and then three years later Red Hat realized it was a security hole,” said Kroah-Hartman.
There is not much the kernel community can do to eliminate bugs, but it can do more testing to find them. The kernel community now has its own security team that’s made up of kernel developers who know the core of the kernel.
“When we get a report, we involve the domain owner to fix the issue. In some cases it’s the same people, so we made them part of the security team to speed things up,” Kroah Hartman said. But he also stressed that all parts of the kernel have to be aware of these security issues because kernel is a trusted environment and they have to protect it.
“Once we fix things, we can put them in our stack analysis rules so that they are never reintroduced,” he said.
Besides fixing bugs, the community also continues to add hardening to the kernel. “We have realized that we need to have mitigations. We need hardening,” said Kroah-Hartman.
Huge efforts have been made by Kees Cook and others to take the hardening features that have been traditionally outside of the kernel and merge or adapt them for the kernel. With every kernel released, Cook provides a summary of all the new hardening features. But hardening the kernel is not enough, vendors have to enable the new features and take advantage of them. That’s not happening.  
Kroah-Hartman [releases a stable kernel every week][5], and companies pick one to support for a longer period so that device manufacturers can take advantage of it. However, Kroah-Hartman has observed that, aside from the Google Pixel, most Android phones don’t include the additional hardening features, meaning all those phones are vulnerable. “People need to enable this stuff,” he said.
“I went out and bought all the top of the line phones based on kernel 4.4 to see which one actually updated. I found only one company that updated their kernel,” he said.  “I'm working through the whole supply chain trying to solve that problem because it's a tough problem. There are many different groups involved -- the SoC manufacturers, the carriers, and so on. The point is that they have to push the kernel that we create out to people.”
The good news is that unlike with consumer electronics, the big vendors like Red Hat and SUSE keep the kernel updated even in the enterprise environment. Modern systems with containers, pods, and virtualization make this even easier. It’s effortless to update and reboot with no downtime. It is, in fact, easier to keep things secure than it used to be.
### Meltdown and Spectre
No security discussion is complete without the mention of Meltdown and Spectre. The kernel community is still working on fixes as new flaws are discovered. However, Intel has changed its approach in light of these events.
“They are reworking on how they approach security bugs and how they work with the community because they know they did it wrong,” Kroah-Hartman said. “The kernel has fixes for almost all of the big Spectre issues, but there is going to be a long tail of minor things.”
The good news is that these Intel vulnerabilities proved that things are getting better for the kernel community. “We are doing more testing. With the latest round of security patches, we worked on our own for four months before releasing them to the world because we were embargoed. But once they hit the real world, it made us realize how much we rely on the infrastructure we have built over the years to do this kind of testing, which ensures that we don’t have bugs before they hit other people,” he said. “So things are certainly getting better.”
The increasing focus on security is also creating more job opportunities for talented people. Since security is an area that gets eyeballs, those who want to build a career in kernel space, security is a good place to get started with.
“If there are people who want a job to do this type of work, we have plenty of companies who would love to hire them. I know some people who have started off fixing bugs and then got hired,” Kroah-Hartman said.
You can hear more in the video below:
[视频](https://youtu.be/jkGVabyMh1I)
_Check out the schedule of talks for Open Source Summit Europe and sign up to receive updates:_
--------------------------------------------------------------------------------
via: https://www.linux.com/blog/2018/10/greg-kroah-hartman-explains-how-kernel-community-securing-linux-0
作者：[SWAPNIL BHARTIYA][a]
选题：[oska874][b]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:https://www.linux.com/users/arnieswap
[b]:https://github.com/oska874
[1]:https://www.linux.com/licenses/category/linux-foundation
[2]:https://www.linux.com/licenses/category/creative-commons-zero
[3]:https://www.linux.com/files/images/greg-k-hpng
[4]:https://www.linux.com/files/images/kernel-securityjpg-0
[5]:https://www.kernel.org/category/releases.html

70
translated/tech/20181002 Greg Kroah-Hartman Explains How the Kernel Community Is Securing Linux.md Normal file
View File

@ -0,0 +1,70 @@
Greg Kroah-Hartman 解释内核社区如何保护 Linux
============================================================
![](https://www.linux.com/sites/lcom/files/styles/rendered_file/public/kernel-security_0.jpg?itok=hOaTQwWV)
内核维护者 Greg Kroah-Hartman 谈论内核社区如何保护 Linux 不遭受损害。[Creative Commons Zero][2]
由于 Linux 使用量持续扩大，内核社区去提高全世界最广泛使用的技术 — Linux 内核的安全性的重要程序越来越高。安全不仅对企业客户很重要，它对消费者也很重要，因为 80% 的移动设备都使用了 Linux。在本文中，Linux 内核维护者 Greg Kroah-Hartman 带我们了解内核社区如何应对威胁。
### bug 不可避免
![Greg Kroah-Hartman](https://www.linux.com/sites/lcom/files/styles/floated_images/public/greg-k-h.png?itok=p4fREYuj "Greg Kroah-Hartman")
Greg Kroah-Hartman [Linux 基金会][1]
正如 Linus Torvalds 曾经说过，大多数安全问题都是 bug 造成的，而 bug 又是软件开发过程的一部分。是个软件就有 bug。
Kroah-Hartman 说：“就算是 bug ，我们也不知道它是安全的 bug 还是不安全的 bug。我修复的一个著名 bug，在三年后才被 Red Hat 认定为安全漏洞“。
在消除 bug 方面，内核社区没有太多的办法，只能做更多的测试来寻找 bug。内核社区现在已经有了自己的安全团队，它们是由熟悉内核核心的内核开发者组成。
Kroah Hartman 说：”当我们收到一个报告时，我们就让参与这个领域的核心开发者去修复它。在一些情况下，他们可能是同一个人，让他们进入安全团队可以更快地解决问题“。但他也强调，内核所有部分的开发者都必须清楚地了解这些问题，因为内核是一个可信环境，它必须被保护起来。
Kroah Hartman 说：”一旦我们修复了它，我们就将它放到我们的栈分析规则中，以便于以后不再重新出现这个 bug。“
除修复 bug 之外，内核社区也不断加固内核。Kroah Hartman 说：“我们意识到，我们需要一些主动的缓减措施。因此我们需要加固内核。”
Kees Cook 和其他一些人付出了巨大的努力，带来了一直在内核之外的加固特性，并将它们合并或适配到内核中。在每个内核发行后，Cook 都对所有新的加固特性做一个总结。但是只加固内核是不够的，供应商必须要启用这些新特性来让它们充分发挥作用。但他们并没有这么做。
Kroah-Hartman [每周发布一个稳定版内核][5]，而为了长周期的支持，公司只从中挑选一个，以便于设备制造商能够利用它。但是，Kroah-Hartman 注意到，除了 Google Pixel 之外，大多数 Android 手机并不包含这些额外的安全加固特性，这就意味着，所有的这些手机都是有漏洞的。他说：“人们应该去启用这些加固特性”。
Kroah-Hartman 说：“我购买了基于 Linux 内核 4.4 的所有旗舰级手机，去查看它们中哪些确实升级了新特性。结果我发现只有一家公司升级了它们的内核”。“我在整个供应链中努力去解决这个问题，因为这是一个很棘手的问题。它涉及许多不同的组织 — SoC 制造商、运营商、等等。关键点是，需要他们把我们辛辛苦苦设计的内核去推送给大家。
好消息是，与消息电子产品不一样，像 Red Hat 和 SUSE 这样的大供应商，在企业环境中持续对内核进行更新。使用容器、pod、和虚拟化的现代系统做到这一点更容易了。无需停机就可以毫不费力地更新和重启。事实上，现在来保证系统安全相比过去容易多了。
### Meltdown 和 Spectre
没有任何一个关于安全的讨论能够避免提及 Meltdown 和 Spectre。内核社区一直致力于修改新发现的和已查明的安全漏洞。不管怎样，Intel 已经因为这些事情改变了它们的策略。
Kroah-Hartman 说：“他们已经重新研究如何处理安全 bug，以及如何与社区合作，因为他们知道他们做错了。内核已经修复了几乎所有大的 Spectre 问题，但是还有一些小问题仍在处理中”。
好消息是，这些 Intel 漏洞使得内核社区正在变得更好。Kroah-Hartman 说：“我们需要做更多的测试。对于最新一轮的安全补丁，在它们被发布之前，我们自己花了四个月时间来测试它们，因为我们要防止这个安全问题在全世界扩散。而一旦这些漏洞在真实的世界中被利用，将让我们认识到我们所依赖的基础设施是多么的脆弱，我们多年来一直在做这种测试，这确保了其它人不会遭到这些 bug 的伤害。所以说，Intel 的这些漏洞在某种程度上让内核社区变得更好了”。
对安全的日渐关注也为那些有才华的人创造了更多的工作机会。由于安全是个极具吸引力的领域，那些希望在内核空间中有所建树的人，安全将是他们一个很好的起点。
Kroah-Hartman 说：“如果有人想从事这方面的工作，我们有大量的公司愿意雇佣他们。我知道一些开始去修复 bug 的人已经被他们雇佣了。”
你可以在下面链接的视频上查看更多的内容：
[视频](https://youtu.be/jkGVabyMh1I)
--------------------------------------------------------------------------------
via: https://www.linux.com/blog/2018/10/greg-kroah-hartman-explains-how-kernel-community-securing-linux-0
作者：[SWAPNIL BHARTIYA][a]
选题：[oska874][b]
译者：[qhwdw](https://github.com/qhwdw)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:https://www.linux.com/users/arnieswap
[b]:https://github.com/oska874
[1]:https://www.linux.com/licenses/category/linux-foundation
[2]:https://www.linux.com/licenses/category/creative-commons-zero
[3]:https://www.linux.com/files/images/greg-k-hpng
[4]:https://www.linux.com/files/images/kernel-securityjpg-0
[5]:https://www.kernel.org/category/releases.html