Google launches the gVisor container runtime [LWN.net]
Google has announced the open-sourcing of gVisor, a sandboxed container runtime. "gVisor is more lightweight than a VM while maintaining a similar level of isolation. The core of gVisor is a kernel that runs as a normal, unprivileged process that supports most Linux system calls. This kernel is written in Go, which was chosen for its memory- and type-safety. Just like within a VM, an application r
Restartable sequences [LWN.net]
Concurrent code running in user space is subject to almost all of the same constraints as code running in the kernel. One of those is that cross-CPU operations tend to ruin performance, meaning that data access should be done on a per-CPU basis whenever possible. Unlike kernel code, though, user-space per-CPU code cannot enter atomic context; it, thus, cannot protect itself from being preempted or
Containers as kernel objects [LWN.net]
The kernel has, over the years, gained comprehensive support for containers; that, in turn, has helped to drive the rapid growth of a number of containerization systems. Interestingly, though, the kernel itself has no concept of what a container is; it just provides a number of facilities that can be used in the creation of containers in user space. David Howells is trying to change that state of
Randomizing structure layout [LWN.net]
May 11, 2017 This article was contributed by Nur Hussein Kees Cook is working on a series of patches for C structure randomization to improve security in the Linux kernel. This is an important part of obfuscating the internal binary layout of a running kernel, making kernel exploits harder. The randstruct plugin is a new GCC add-on that lets the compiler randomize the layout of C structures. When
Defending against Rowhammer in the kernel [LWN.net]
The Rowhammer vulnerability affects hardware at the deepest levels. It has proved to be surprisingly exploitable on a number of different systems, leaving security-oriented developers at a loss. Since it is a hardware vulnerability, it would appear that solutions, too, must be placed in the hardware. Now, though, an interesting software-based mitigation mechanism is under discussion on the linux-k
Why kernel development still uses email [LWN.net]
LWN.net needs you!Without subscribers, LWN would simply not exist. Please consider signing up for a subscription and helping to keep LWN publishing In a world full of fancy development tools and sites, the kernel project's dependence on email and mailing lists can seem quaintly dated, if not positively prehistoric. But, as Greg Kroah-Hartman pointed out in a Kernel Recipes talk titled "Patches car
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Backdoored images downloaded 5 million times finally removed from Docker Hub (ars technica) [LWN.net]
Kernel page-table isolation merged [LWN.net]
KAISER: hiding the kernel from user space [LWN.net]
Red Hat Enterprise Linux for ARM64 [LWN.net]
Control groups, part 6: A look under the hood [LWN.net]
[RFC PATCH] KEYS: Allow a live daemon in a namespace to service request_key upcalls [LWN.net]
A formal kernel memory-ordering model (part 1) [LWN.net]
The "Upspin" global filesystem [LWN.net]
kvmalloc() [LWN.net]
Topics in live kernel patching [LWN.net]
Kernel development [LWN.net]
Documentation/networking/strparser.txt (v4.9) [LWN.net]
Kernel development [LWN.net]
cgroup: Add new capability to allow a process to migrate other tasks between cgroups [LWN.net]