Writing kernel exploits

Yesterday I gave a talk about writing kernel exploits. I've posted the slides [PDF]. Here is the original description:

Did you know that a NULL pointer can compromise your entire system? Do you know how UNIX pipes, multithreading, and an obscure network protocol from 1981 are combined to take over Linux machines today? OS kernels are full of strange and interesting vulnerabilities, thanks to the subtle nature of systems code. And the kernel's ultimate authority is the ultimate prize for an attacker.

In this talk you will learn how kernel exploits work, with detailed code examples. Compared to userspace, exploiting the kernel requires a whole different bag of tricks, and we'll cover some of the most important ones. We will focus on Linux systems and x86 hardware, though most ideas will generalize. We'll start with a few toy examples, then look at some real, high-profile Linux exploits from the past two years.

You will also see how to protect your own Linux machines against kernel exploits. We'll talk about the continual cat-and-mouse game between system administrators and those who would attack even hardened kernels.

Thanks again to SIPB for giving me a venue to talk about whatever I find interesting.

Slides from "Why learn Haskell?"

Yesterday I gave a talk on the topic of "Why learn Haskell?", and I've posted the slides [PDF]. Thanks to MIT's SIPB for organizing these talks and providing tasty snacks. Thanks also to the Boston Haskell group for lots of useful feedback towards improving my talk.

If you'd like to adapt my slides for your own venue, the source is available under a CC-By-SA license. I rendered the PDF using pandoc and Beamer.

New slides and how I made them

New slides

I've posted PDFs of slides from some talks I gave a while ago.

First-Class Concurrency in Haskell covers topics in concurrent imperative programming, such as:

• Using closures with concurrency primitives to improve your API

• Using MVar to retrieve thread results, as in spawn

• How System.Timeout works

• Implementing IORef and Chan in terms of other primitives

• Implementing the π-calculus, and compiling the λ-calculus to it

This turned out to be far too much material for a one-hour talk, so the slides are probably more valuable than the talk itself. I'm also thinking of expanding the π-calculus bits into a proper blog post at some point.

High-level FFI in Haskell covers tricks for making bindings to C libraries that feel more like native Haskell libraries. Most of the examples are drawn from my hdis86 library . This includes:

• Translating C types to idiomatic Haskell types

• Passing Haskell functions as C function pointers

• Passing ByteStrings as C buffers

• Automatic locking and memory management of library state

• Exposing a C library's state machine as a lazy pure function

• Bundling a C library with Cabal while also allowing dynamic linking

These slides were available before, in a somewhat strange HTML format. The new PDFs are more portable and I think they look nicer, too.

How I made the slides

I originally wrote the slides in Markdown format and converted them to a S5 slideshow using pandoc. This was a great way to quickly prepare slides, including syntax-highlighted Haskell code. However I ran into a few limitations:

• Slide layout depends on window size and screen resolution, rendering my obsessive tweaking useless. In some cases the text would run off the edge of the screen or overlap other elements.

• The slides don't work at all in Chromium, as of the S5 version I used initially. I also got reports of issues with other browsers.

I wanted to switch over to Beamer, as I'd seen some very high-quality slides produced using that package. This would also provide a PDF that renders exactly the same on every machine. Fortunately, pandoc can output L^aT_eX code suitable for Beamer. I can keep using the lightweight syntax of Markdown, and most of my old slide source code works as-is. Once again pandoc handles a tricky problem with ease.

I followed this scheme with a few modifications. For example, pdflatex was unhappy with slides ("frames") containing verbatim text environments. The solution was to declare all frames as "fragile", whatever that means:

\begin{frame}[fragile]

Recent versions of pandoc accept the --listings option and will use the L^aT_eX listings package to render nicely-formatted source code. This article was helpful for configuring listings. The default Haskell style has a rather odd definition of what counts as a keyword, so I wrote a custom language definition. I ended up with this L^aT_eX header, which you can pass to pandoc using -H:

\usepackage{listings}
\usepackage{color}

\lstdefinelanguage{Haskell_mod}{
    otherkeywords={.., ::, |, <-, ->, @, ~, =, =>},
    morekeywords={
       case, class, data, default, deriving, do, else,
       foreign, if, import, in, infix, infixl, infixr,
       instance, let, module, newtype, of, then, type,
       where, _, forall, ccall },
    sensitive,
    morecomment=[l]--,
    morecomment=[n]{\{-}{-\}},
    morestring=[b]"
}[keywords,comments,strings]

\lstset{
    language=Haskell_mod,
    basicstyle=\ttfamily,
    keywordstyle=\color[rgb]{0,0,1},
    commentstyle=\color[rgb]{0.133,0.545,0.133},
    stringstyle=\color[rgb]{0.627,0.126,0.941},
    showstringspaces=false,
    frame=single
}

The Markdown sources for the slides are available: 1, 2.

My biggest remaining complaint is that I have a lot of explicit spacing commands, e.g. \vspace{1em}. These are used for logical grouping, and so can't be fully inferred, but maybe there's a better (partial?) solution.