Linux Security Summit Europe 2018

The Linux Kernel Hardening Project is making significant strides in reducing vulnerabilities and in increasing the effort required to exploit vulnerabilities that remain. Much of what has been implemented is obviously valuable, but sometimes the benefit is more subtle. How does the introduction of refcount_t make the kernel more secure, and by how much? What value is there in removing variable length arrays? Casey Schaufler, a (really) long time kernel developer will explain why some of these changes provide significantly greater value than might be apparent to the casual observer. He will discuss the cost of kernel hardening in terms of development overhead, code churn and performance.