Google to fund Linux developers to fix kernel security problems

Google and the Linux Foundation have jointly announced that they will fund two full-time developers for Linux kernel security development.

Gustavo Silva and Nathan Chancellor have been giving the go-ahead to maintain and improve kernel security and associated initiatives to ensure the open source software project is secure.

According to a recently published open source contributor survey, there’s a need for additional work on open-source software security, including Linux. The Linux Foundation said while there are thousands of Linux kernel developers, this contribution from Google to underwrite two full-time Linux security maintainers signals the importance of security in the ongoing sustainability of open source software.

“At Google, security is always top of mind and we understand the critical role it plays to the sustainability of open source software,” said Dan Lorenc, staff Software Engineer at Google. “We’re honored to support the efforts of both Gustavo Silva and Nathan Chancellor as they work to enhance the security of the Linux kernel.”

The foundation said Chancellor’s work will focus on triaging and fixing all bugs found with Clang/LLVM compilers while establishing continuous integration systems to support this ongoing work.

“Once those aims are well-established, he plans to begin adding features and polish to the kernel using these compiler technologies,” according to the Foundation.

Chancellor has been working on the Linux kernel for four and a half years. Two years ago, Chancellor started contributing to mainline Linux under the ClangBuiltLinux project, a collaborative effort to get the Linux kernel building with Clang and LLVM compiler tools.

“I hope that more and more people will start to use the LLVM compiler infrastructure project and contribute fixes to it and the kernel – it will go a long way towards improving Linux security for everyone,” said Chancellor.

Silva has recently been working on eliminating several buffer overflow classes by transforming all instances of zero-length and one-element arrays into flexible-array members, which is the preferred and least error-prone mechanism to declare such variable-length types.

He will also focus on fixing bugs while developing defense mechanisms that cut off whole classes of vulnerabilities. Silva said the foundation was working toward building a high-quality kernel that’s “reliable, robust and more resistant to attack every time.”

 “Through these efforts, we hope people, maintainers, in particular, will recognize the importance of adopting changes that will make their code less prone to common errors,” Silva added.

See the original article here: ITPro