OpenBSD 将在每次重启后都使用和之前不同的内核
内核 安全
![OpenBSD logo](/data/attachment/album/201707/09/065441s17rj4etrjujukdj.jpg)


在 OpenBSD 的测试快照中加入了一个新的功能，每次当 OpenBSD 用户重启或升级计算机时都会创建一个独特的内核。


该功能被称之为 KARL（<ruby> 内核地址随机化链接 <rp>  （ </rp> <rt>  Kernel Address Randomized Link </rt> <rp>  ） </rp></ruby>），即以随机的顺序重新链接其内部的内核文件，从而每次生成一个独特的内核二进制文件。


当前的稳定版中，OpenBSD 内核使用预先定义好的顺序来链接和加载内核二进制文件中的内部文件，这导致所有用户的内核都是一样的。


### KARL 与 ASLR 不同


KARL 由 Theo de Raadt 开发。KARL 会在安装、升级和重启时生成一个新的内核二进制文件。当用户启动、升级和重启机器时，最新生成的内核会替换已有的内核二进制，而操作系统会生成一个新的内核，其将用于下次启动、升级和重启，周而复始。


不要将 KARL 和 ASLR（<ruby> 地址空间布局随机化 <rp>  （ </rp> <rt>  Address Space Layout Randomization </rt> <rp>  ） </rp></ruby>）相混淆，ASLR 是一种用于随机化应用代码执行的内存地址的技术，以防止知道应用或内核运行的特定区域而被针对性利用。


de Raadt 说，“它仍然装载在 KVA（<ruby> 内核虚拟地址空间 <rp>  （ </rp> <rt>  Kernel Virtual Address Space </rt> <rp>  ） </rp></ruby>）中的同样位置，这不是内核的 ASLR！”


相反，KARL 以随机的内部结构生成内核二进制，这样漏洞利用程序就不能泄露或攻击内核内部函数、指针或对象。技术性的解释参见下面内容。


一个独特的内核是这样链接的，启动汇编代码仍放在原处，接着是随机大小的空隙，然后是随机重组的其它 .o 文件。这样的结果就是函数和变量之间的距离是全新的。一个指针的信息泄露将不会暴露其它指针或对象。这或许会减少可变体系架构的组件，因为指令流的多态性被嵌套偏移的改变所破坏。


“因此，每次的新内核都是独特的。”de Raadt 说。


### 该功能是最近两个月开发的


该功能的开发始于五月份，[首次讨论](https://marc.info/?l=openbsd-tech&m=149732026405941&w=2)出现于六月中旬的 OpenBSD 技术邮件列表中。KARL [最近出现于](http://marc.info/?l=openbsd-tech&m=149887978201230) OpenBSD 6.1 的快照版本中。


“当今的情况是许多人从 OpenBSD 安装内核二进制，然后这个相同的内核二进制将运行六个月以上。当然，如果你重复地引导这个相同的内核二进制，其内存布局也是一样的。这就是现在我们所提交的代码解决的问题。”de Raadt 说，“然而， -current 快照包含了一些我正在和 Robert Peichaer 开发的将来的变化。那个变化将可以使你每次重启都启动到一个新链接的内核上。”


### KARL 是一个独有的功能


一个销售针对隐私的硬件产品的初创企业 Technoethical 的创始人 Tiberiu C. Turbureanu 对 Bleeping Computer 说，这是一个 OpenBSD 独有的功能。


“在 Linux 中没有实现它，”Turbureanu 说，“看起来很棒的想法”，估计有可能该功能会移植到 Linux 内核中。


不过，Linux 刚刚增加了对 KASLR（<ruby> 内核地址空间布局随机化 <rp>  （ </rp> <rt>  Kernel Address Space Layout Randomization </rt> <rp>  ） </rp></ruby>）的支持，该功能是将 KSLR 移植到了内核本身，它会将内核加载到随机的内存地址。


该功能在上周发布的 Linux 4.12 中[默认启用](https://www.phoronix.com/scan.php?page=news_item&px=KASLR-Default-Linux-4.12)。这两者的不同是 KARL 是装载不同的内核到同一个位置，而 KASLR 则是装载相同的二进制到随机的位置。目标相同，做法不同。


在 Windows 中没有支持 KARL，但是微软使用 KASLR 已经很多年了。反病毒创客公司 Emsisoft 的 CTO Fabian Wosar 正在全力将 KARL 增加到 Windows 内核中。


“OpenBSD 的这个思路需要进一步发扬到（当前的 Windows 内核防护中），这样大家都可以有一个独特内核二进制了，”Wosar 在和 Bleeping Computer 的私人谈话中说到。


“即便是你知道了（随机的）内核起始点，你也不能用它来找到要定位的特定函数，函数相对于内核起始点的位置是随系统不同而不同的，”Wosar 补充说。


其它的操作系统平台，如 Windows 和 Linux ，如果拥有 KARL 将极大的改善其用户的安全性。


OK
A new feature added in test snapshots for OpenBSD releases will create a unique kernel every time an OpenBSD user reboots or upgrades his computer.

This feature is named KARL — Kernel Address Randomized Link — and works by relinking internal kernel files in a random order so that it generates a unique kernel binary blob every time.

Currently, for stable releases, the OpenBSD kernel uses a predefined order to link and load internal files inside the kernel binary, resulting in the same kernel for all users.

## KARL is different from ASLR

Developed by Theo de Raadt, KARL will work by generating a new kernel binary at install, upgrade, and boot time. If the user boots up, upgrades, or reboots his machine, the most recently generated kernel will replace the existing kernel binary, and the OS will generate a new kernel binary that will be used on the next boot/upgrade/reboot, constantly rotating kernels on reboots or upgrades.

KARL should not be confused with ASLR — Address Space Layout Randomization — a technique that randomizes the memory address where application code is executed, so exploits can't target a specific area of memory where an application or the kernel is known to run.

"It still loads at the same location in KVA [Kernel Virtual Address Space]. This is not kernel ASLR!," said de Raadt.

Instead, KARL generates kernel binaries with random internal structures, so exploits cannot leak or attack internal kernel functions, pointers, or objects. A technical explanation is available below.

"As a result, every new kernel is unique," de Raadt says.

## Feature developed in the last two months

Work on this feature started in May and was [first discussed](https://marc.info/?l=openbsd-tech&m=149732026405941&w=2) in mid-June on the OpenBSD technical mailing list. KARL has [recently landed](http://marc.info/?l=openbsd-tech&m=149887978201230) in snapshot versions of OpenBSD 6.1.

"The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. Of course, if you booted that same kernel binary repeatedly, the layout would be the same. That is where we are today, for commited code," de Raadt says.

"However, snapshots of -current contain a futher change, which I worked on with Robert Peichaer. That change is scaffolding to ensure you boot a newly-linked kernel upon every reboot.

## KARL is a unique feature

Speaking to Bleeping Computer, Tiberiu C. Turbureanu, founder of [Technoethical](https://tehnoetic.com), a startup that sells [privacy-focused hardware products](https://www.bleepingcomputer.com/news/hardware/there-are-only-25-devices-that-respect-your-privacy/), says this feature appears to be unique to OpenBSD.

"It's not implemented in Linux," Turbureanu said. "This looks like a great idea," the expert added, regarding the possibility of having this feature ported to the Linux kernel.

Instead, the Linux project has just added support for Kernel Address Space Layout Randomization (KASLR), a feature that ports ASLR to the kernel itself, loading the kernel at a randomized memory address.

This feature was [turned on by default](https://www.phoronix.com/scan.php?page=news_item&px=KASLR-Default-Linux-4.12) in Linux 4.12, released last week. The difference between the two is that KARL loads a different kernel binary in the same place, while KASLR loads the same binary in random locations. Same goal, different paths.

As for Windows, KARL is not supported, but Microsoft has used KASLR for many years. Fabian Wosar, Chief Technical Officer for antivirus maker [Emsisoft](https://www.emsisoft.com/) is all on board with adding KARL to the Windows kernel.

"OpenBSD's idea would go even further [than current Windows kernel protections] as everyone would have a unique kernel binary as well," Wosar said in a private conversation with Bleeping Computer.

"So even if you had the address where the kernel starts (which is randomised), you couldn't use it to figure out where certain functions are located, as the location of the functions relative to the kernel start will be different from system to system as well," Wosar added.

Having KARL on other OS platforms would greatly improve the security of both Windows and Linux users.

## Comments

## kenhall5551 - 7 years ago

This is a GREAT idea. But because Microsoft can't patten and control it's distribution, we will probably not see it there. There's hope for Linux though.

## EmpressTrudy - 7 years ago

The fact that Windows has used KASLR for several years is hardly a ringing endorsement, no?

## campuscodi - 7 years ago

Actually KASLR on windows has been very successful. At least compared to previous versions where rootkits were the norm.

## DavidsonDFGL - 7 years ago

Noob question:




So, in general terms, means that KARL 'just' randomly joins objects, I mean:

final-obj: obj

obj1.o obj2.o obj3.o

It could be:

final-obj: obj

obj3.o obj1.o obj2.o?

I do not understand much of the linux kernel.