this post was submitted on 19 Jul 2024
1266 points (99.4% liked)
Programmer Humor
19184 readers
1129 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Because it isn't. Their Linux sensor also uses a kernel driver, which means they could have just as easily caused a looping kernel panic on every Linux device it's installed on.
There's no way of knowing that, though. Perhaps their Linux and Darwin drivers wouldn't have paniced the system?
Regardless, doing almost anything at the kernel level is never a good idea
It's not impossible. Crowdstrike has done it recently to linux machines.
Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process:
https://access.redhat.com/solutions/7068083
Paywalled, unfortunately
Also, it's less about "their" drivers and more about what a kernel module can do.
Saying "there's no way to know" doesn't fit, because we do know that a malformed kernel module can destabilize a linux or mac system.
"Malformed file" isn't a programming defect or something you can fix by having a better API.
Having the data exposed to userspace via an API would avoid having to have a kernel module at all... Which when malformed wouldn't compromise the kernel.
I mean, sure. But typically operating systems don't expose that type of information to user space, instead providing a kernel interface with user mode configuration.
It's why they use the same basic approach on mac and Linux.
Security operations being one of the things that is often best done at the kernel level because of the need to monitor network and file operations in a way you can't in user mode.