Difference between revisions of "Active Projects"

From Linux Kernel Security Subsystem
Jump to navigation Jump to search
 
(18 intermediate revisions by 2 users not shown)
Line 1: Line 1:
There are a number of active Linux Kernel hardening projects and this page gives details on some of them.
The [[Linux Security Workgroup]] has put together this page in an effort to bring the Linux security community together in hardening the Linux Kernel and to help prevent duplication of efforts. There are a number of active Linux Kernel hardening projects and this page gives details on some of them.


= Static Analysis =
= Static Analysis =
Line 7: Line 7:
[http://en.wikipedia.org/wiki/Coccinelle_(software) Coccinelle] is a tool for matching and fixing source code for C, C++, and other languages.
[http://en.wikipedia.org/wiki/Coccinelle_(software) Coccinelle] is a tool for matching and fixing source code for C, C++, and other languages.


Who's running it: Fengguang Wu, Artem Bityutskiy
Run by:
 
* Fengguang Wu - Running against what trees?
Targeted subsystems: ?
* Artem Bityutskiy - Running against what trees?


== Coverity ==
== Coverity ==
Line 15: Line 15:
[http://en.wikipedia.org/wiki/Coverity Coverity] provides static analysis tools for C, C++, and other languages.  Red Hat's Coverity license allows results to be shared with upstream projects.
[http://en.wikipedia.org/wiki/Coverity Coverity] provides static analysis tools for C, C++, and other languages.  Red Hat's Coverity license allows results to be shared with upstream projects.


Who's running it: ? (Red Hat)
Run by: Paul Moore at Red Hat against what trees?
 
Targeted subsystems: ?


== Smatch ==
== Smatch ==
Line 23: Line 21:
[http://smatch.sourceforge.net/ Smatch] is a static analysis tool for C.
[http://smatch.sourceforge.net/ Smatch] is a static analysis tool for C.


Who's running it: Dan Carpenter, Fengguang Wu
Run by:
* Dan Carpenter - Running against linux-next x86_64 allmodconfig
* Fengguang Wu - Running against what trees?
 
= Dynamic Analysis =
 
== kmemcheck, kmemleak ==
 
Linux Kernel debugging features for detecting memory issues.
 
Run by: ?
 
== KEDR ==
 
[http://kedr.berlios.de/ KEDR] provides runtime analysis of Linux kernel modules including device drivers, file system modules, etc.


Targeted subsystems: ?
Run by: ?


= Fuzz Testing =
= Fuzz Testing =
Line 33: Line 45:
[http://codemonkey.org.uk/projects/trinity/ Trinity] is a Linux system call fuzzer.
[http://codemonkey.org.uk/projects/trinity/ Trinity] is a Linux system call fuzzer.


Who's running it: Dave Jones, Fengguang Wu
Run by: Dave Jones and Fengguang Wu
 
== Metasploit ==
 
[http://www.metasploit.com/ Metasploit] software is used for identifying security issues.  It includes many capabilities, including fuzzer support.
 
Run by: ?
 
= Development =
 
== ASLR for kernel code ==
 
Kernel text and module base address now randomized on x86. Next will be arm64 and arm.


Targeted subsystems: N/A?
Project Owner: Google, Linaro

Latest revision as of 22:46, 4 November 2015

The Linux Security Workgroup has put together this page in an effort to bring the Linux security community together in hardening the Linux Kernel and to help prevent duplication of efforts. There are a number of active Linux Kernel hardening projects and this page gives details on some of them.

Static Analysis

Coccinelle

Coccinelle is a tool for matching and fixing source code for C, C++, and other languages.

Run by:

  • Fengguang Wu - Running against what trees?
  • Artem Bityutskiy - Running against what trees?

Coverity

Coverity provides static analysis tools for C, C++, and other languages. Red Hat's Coverity license allows results to be shared with upstream projects.

Run by: Paul Moore at Red Hat against what trees?

Smatch

Smatch is a static analysis tool for C.

Run by:

  • Dan Carpenter - Running against linux-next x86_64 allmodconfig
  • Fengguang Wu - Running against what trees?

Dynamic Analysis

kmemcheck, kmemleak

Linux Kernel debugging features for detecting memory issues.

Run by: ?

KEDR

KEDR provides runtime analysis of Linux kernel modules including device drivers, file system modules, etc.

Run by: ?

Fuzz Testing

Trinity

Trinity is a Linux system call fuzzer.

Run by: Dave Jones and Fengguang Wu

Metasploit

Metasploit software is used for identifying security issues. It includes many capabilities, including fuzzer support.

Run by: ?

Development

ASLR for kernel code

Kernel text and module base address now randomized on x86. Next will be arm64 and arm.

Project Owner: Google, Linaro