Huawei Proposes In-Kernel Transactional Database For Security Purposes

Written by Michael Larabel in Linux Security on 26 June 2021 at 06:28 AM EDT. 11 Comments
LINUX SECURITY
While some Huawei engineers are currently facing criticism for submitting superfluous kernel patches in an effort to boost their own or the company's standing in the kernel community, other engineers at Huawei are working on more substantive kernel patches. Here's a rather peculiar new patch series out on Friday where a Huawei engineer is effectively proposing an in-kernel transactional database.

The new proposal is a feature called "Huawei Digest Lists" as an in-kernel database for storing file and metadata digests. The intended use-case would be around integrity measurement (IMA) and exposing the database to user-space through SecurityFS.

Among the data intended for Digest Lists could be RPM headers and Debian repository metadata information. Huawei is pursuing the in-kernel database design so that it's stored within kernel memory and less prone to user-space attacks. Huawei Digest Lists are already in use with their openEuler Linux distribution.

Those interested in all the technical details on this Huawei Digest Lists proposal can find the cover letter and patches on the kernel mailing list. The "digest_lists" kernel implementation in its current form is just under four thousand lines of code.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week