IO_uring security / vulnerabilties?

[cyber_trout]

That news caught my eye.

Linux 6.6 Will Make It Easy To Disable IO_uring System-Wide

Whonix uses IO_uring now, i wonder maybe kernels should be recompiled with IO_uring disabled to stay on a safe side?

[raja]

I also had a look at this a while back but have not had the time to test any performance implications or other compatibility related issues. Given we are running Debian, it should probably be tested thoroughly on Bookworm.

It certainly seems like something we should disable given the statistics provided by Google. Regardless, I will attempt to look more thoroughly into this kernel parameter.

[Patrick]

@cyber_trout

i wonder maybe kernels should be recompiled

Written just now:

kernel recompilation for better hardening

A hardened kernel is generally highly unlikely to happen anytime soon. There’s no actively maintained, Free and Open Source hardened kernel project which provides a Linux kernel compatible with Debian (stable) (and VMs). There are too many configuration options. See this example. And the Kicksecure or Whonix project doesn’t have resources to pay a kernel developer (most likely full time) to keep maintaining all of this (which includes figuring out which configuration option breaks what). Kick…

[raja]

One way we can gauge the impact of changing this parameter is by following what happens in the linux-hardened kernel for Arch Linux:

Disable io_uring

Since we are probably going to stick with Debian and so not going to move to (or past) kernel 6.6 anytime in the next two years, perhaps we could make an exception to change this one kernel parameter after it is thoroughly tested on linux-hardened.

[raja]

Disable asynchronous I/O

[raja]

I agree that in order to reduce contributor burden with regards to versioning it is a good idea to add the sysctl in as long as it doesn’t break anything. As contributors come and go over the years it can become easy to overlook small niche edits like this.

Another benefit is that a lot of people use security-misc settings as a base to harden their systems and so might as well provide them a complete set of options.

So should I leave as is or should add a comment saying that this PR is just for display and only useful for kernel 6.6 and above?

[Patrick]

Merged now. Thank you!

@raja

for display and only useful for kernel 6.6 and above?

That would be useful.

[raja]

Clarify validity of disabling io_uring

[Patrick]

Merged, thank you!

[Patrick]

Since this was brought up again in Minor documentation changes by raja-grewal · Pull Request #244 · Kicksecure/security-misc · GitHub

@raja

So should I leave as is or should add a comment saying that this PR is just for display and only useful for kernel 6.6 and above?

If there are settings which cannot be enabled yet, need to be re-checked, are a potential source of issues in a future version of Debian, we could add comments such as:

## TODO: Debian trixie

I’ll search the source code for trixie before porting to a new major Debian version to handle such todo items.

[raja]

Yes this is a good idea!