Linus Torvalds criticizes Linux kernel security patch process, per ZDNET

What happened

ZDNET reported that Linus Torvalds, the creator and main developer of the Linux kernel (the core software that manages a computer’s basic operations), has criticized the way some security specialists approach kernel changes. The article is written by Charlie Osborne and does not give a publication date [2].

The dispute centred on a pull request, which is a formal request asking the project’s maintainers to add a set of code changes. Google Pixel developer Kees Cook submitted one for “hardened usercopy” changes for version 4.15-rc1. According to Cook, the changes narrow the areas of memory that can be copied to and from userspace, the part of a computer where ordinary programs run, by adding explicit whitelisting for slab cache regions. Whitelisting here means listing the only areas that are allowed [2].

Cook said the change had sat in the testing branch called -next for some time without major problems. Some whitelists were found missing late in the process, so a fallback mode was added. Cook said, “I expect to remove the fallback mode in a release or two” [2].

Torvalds responded that these kinds of requests “can be very painful,” because reviewers must spend time on code that touches core parts of the kernel. He said, “I don’t trust security people to do sane things,” and that he has no time to examine such requests when he handles more than 20 others a day [2]. ZDNET reports that he also cast doubt on the validity of the request [2].

Torvalds also objected to security rules that make the kernel panic, meaning crash, when the new rules are broken. He called that approach unacceptable. ZDNET says he used a crude insult to describe some security people’s behaviour. He said the focus should be on debugging and on making the future release better than the version in use today [2].

The ZDNET page also links to a related headline about new rules for AI-assisted code in the Linux kernel. The sources do not include the content of those rules, so this report cannot say what they require, when they were proposed or what stage they are at [2].

Who is affected

The sources name Linux kernel developers and the security professionals who submit or review kernel changes, along with Google Pixel developer Kees Cook, who submitted the pull request [2].