Kernel Hardening With Protection Keys
summary
Implements a KB keys framework that uses hardware protection keys (pkeys/permission overlay) on arm64 to make high-value kernel data page tables and struct cred read-only by default and grant per-thread write access only via a controlled PKRU switch; prototype on Graviton3 uses a mock PoE and lazy MMU batching to avoid per-PTE PKRU writes and reports about ~4% system time overhead on currentbench with microbench spikes without batching, and negligible cred overhead in tested workloads.
AI-written summary · about
chapters (7)
- 0:00The problem of data-only attacks
- 2:22Understanding data-only exploits
- 4:56Protection keys overview
- 8:44Page table protection implementation
- 14:41Hardening struct cred
- 18:45Framework status and future work
- 21:41Questions and answers
related talks
38mKernel Hardening: Protecting the Protection Mechanisms
50mMPK/PKS Linux Kernel Compartmentalization
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
38mTaking Kernel Hardening to the Next Level
19mEPK: Scalable and Efficient Memory Protection Keys
50mProtected KVM on Arm64: A Technical Deep Dive
46mKernel Hardening for 32-bit Arm Processors
42mTPMs and the Linux Kernel: unlocking a better path to hardware security