Post #1882959

The bug’s existence undermines typical ‘secure by default’ postures and isolation principles. Kernel-level vulnerabilities like this bypass many layered perimeter defenses and assume a total breakdown of system integrity. wtf no. It simply highlights that Linux/UNIX's security model is a disaster from the very beginning, and that the choice of C and accepting its weak typing model instead of emulating something better (or using tools that permit much the same without a runtime cost) was an awful decision. (The entire bug could've been avoided with Ada typing & contract features, probably detected purely at compile time.) You can't say "secure by default" and "isolation" are undermined while talking about a kernel that is rife with ambient authority and where any kernel thread is free to fuck everything else in the system over at any given moment. (Sure there's a privileged core/runtime necessary at some point, but there's zero reason kernel threads should have access to everything else and merely politely pretend they don't. They should only have the capabilities they need.) That code should never even have been part of a privileged surface in the first place, it should've been a userspace server passed capabilities for what it needs and otherwise operated without any privileges.