State of Linux Desktop Security

栏目: IT技术 · 发布时间: 5年前

I made a tweet claiming that Linux is behind on security mitigations. This post is to outline mitigations added to platforms such as Windows, MacOS, and even ChromeOS that have yet to see the light of day on the linux desktop.

(Btw, Andrew Kelley is my hero!)

Linux distros are behind on implementing modern binary exploit mitigations. The last thing Linux userspace has done is ASLR/PIE and stack canaries: this hasen't changed for years. Windows and MacOS enforce signature checking on all binaries. glibc's allocator is primitive compared to LLVM's Scudo allocator, which mitigates use-after-frees and heap overflows.

Windows signs heap pages to ensure they're immutable, in addition to hardware-enforced control flow protection. Modern iOS does this too. Windows also implemented something exciting called a shadow stack, which stores return addresses in a secret, seperate stack from local variables. This is both faster and more secure than stack cookies.

Linux distros have no concept of sandboxing, or any meaningful application security model. Any app running under Xorg can see the contents of any other app runing under Xorg. Flatpack and snap are both security nightmares , fundamentally flawed and poorly implemented. The only good sandoxing API provided by the Linux kernel is seccomp-bpf, and the only program that uses it is Google Chrome/Chromium. To compare, ChromeOS requires every service to have its own seccomp filter .

Also a friendly reminder that Debian is always behind on CVEs, and I'm sure that most distros don't fare any better.


以上就是本文的全部内容,希望本文的内容对大家的学习或者工作能带来一定的帮助,也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

Python高效开发实战——Django、Tornado、Flask、Twisted(第2版)

Python高效开发实战——Django、Tornado、Flask、Twisted(第2版)

刘长龙 / 电子工业出版社 / 2019-1 / 99

也许你听说过全栈工程师,他们善于设计系统架构,精通数据库建模、通用网络协议、后端并发处理、前端界面设计,在学术研究或工程项目上能独当一面。通过对Python 3及相关Web框架的学习和实践,你就可以成为这样的全能型人才。 《Python高效开发实战——Django、Tornado、Flask、Twisted(第2版)》分为3篇:上篇是Python基础,带领初学者实践Python开发环境,掌握......一起来看看 《Python高效开发实战——Django、Tornado、Flask、Twisted(第2版)》 这本书的介绍吧!

HTML 编码/解码
HTML 编码/解码

HTML 编码/解码

URL 编码/解码
URL 编码/解码

URL 编码/解码

RGB CMYK 转换工具
RGB CMYK 转换工具

RGB CMYK 互转工具