{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/kernel","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/kernel/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/kernel/"},"term":{"en":"Kernel","da":"Kerne (kernel)"},"aka":{"en":[],"da":["kernel"]},"domain":["cs"],"cluster":"os","layer":"os","status":"current","era":1969,"summary":{"en":"The core of the operating system, which has full control of the machine and decides what every program may do.","da":"Kernen i styresystemet, som har fuld kontrol over maskinen og bestemmer, hvad hvert program må."},"body":{"formal":{"en":"The part of the operating system that runs with full rights over the machine. Ordinary programs cannot touch devices, memory or each other's data directly; they must ask the kernel, which checks and carries out each request.","da":"Den del af styresystemet, der kører med fulde rettigheder over maskinen. Almindelige programmer kan ikke røre udstyr, hukommelse eller hinandens data direkte; de må bede kernen, som kontrollerer og udfører hver anmodning."},"plain":{"en":"Like the staff at a bank vault - customers never walk into the vault themselves; they hand a slip over the counter, and staff decide whether to fetch what was asked for.","da":"Som personalet ved bankboksen - kunderne går aldrig selv ind i boksen; de afleverer en seddel ved skranken, og personalet afgør, om de vil hente det ønskede."},"inPractice":{"en":"After the Danish Resilience Agency (home of CFCS) warns about a flaw in the Linux kernel, the IT operations lead at a water utility patches the control servers and restarts them, because the new kernel only takes over after a restart.","da":"Efter at SAMSIK har advaret om en sårbarhed i Linux-kernen, patcher den IT-driftsansvarlige på et vandværk styringsserverne og genstarter dem, fordi den nye kerne først tager over efter en genstart."},"whyItMatters":{"en":"Because the kernel can do anything, an attacker who takes it over controls the whole machine and can hide from every other defence on it.","da":"Fordi kernen kan alt, kontrollerer en angriber, der overtager den, hele maskinen og kan skjule sig for alle andre forsvar på den."}},"deepDive":{"en":"The kernel's authority comes from CPU privilege levels. On x86 it runs in ring 0 (supervisor mode), user programs in ring 3; on ARMv8 the equivalents are EL1 and EL0, with hypervisors at EL2. Only privileged code may change page tables, mask interrupts, access I/O ports or reconfigure the CPU, so user space has to cross the boundary through a controlled entry point: on x86-64 the syscall instruction jumps to an address the kernel stored in the LSTAR model-specific register, the kernel validates arguments, copies data across with dedicated helpers (copy_from_user in Linux), performs the work and returns. Interrupts and exceptions such as page faults enter the kernel the same way. Every system call is therefore a trust boundary, and most kernel vulnerabilities are memory-safety errors in code that parses data from user space or from devices.\n\nArchitectures differ in how much runs in that privileged space. Linux is monolithic: the scheduler, memory manager, file systems, network stack and device drivers all run in ring 0 in one address space, extensible at runtime with loadable modules. Microkernels such as seL4 or QNX keep only address spaces, threads and inter-process communication in the kernel and push drivers and file systems into user-space servers, trading performance for isolation; seL4 is notable for a machine-checked proof of functional correctness. Windows NT and Apple's XNU are usually described as hybrids, but in practice run most drivers in kernel mode.\n\nThat is the main security weakness: any kernel-mode driver has full power. Attackers exploit it through bring-your-own-vulnerable-driver (loading a legitimately signed but flawed driver to gain ring-0 access and kill EDR), and defenders see the other side in incidents like the CrowdStrike Falcon update of 19 July 2024, where a faulty content file processed by a kernel driver crashed about 8.5 million Windows machines. Mitigations include mandatory driver signing and Microsoft's vulnerable-driver blocklist, virtualisation-based security (HVCI, \"memory integrity\"), KASLR, SMEP and SMAP (preventing the kernel from executing or accessing user pages unexpectedly), kernel page-table isolation added after Meltdown in 2018, and, in Linux, eBPF as a verified in-kernel sandbox so that monitoring tools need not ship custom modules. Rust is now accepted for new Linux kernel drivers.\n\nOperationally, a kernel update normally requires a reboot because the running image cannot simply be replaced; live-patching facilities (kpatch, Livepatch, Windows hotpatch on supported editions) apply limited function-level fixes in memory. Since February 2024 the Linux kernel project has been its own CVE Numbering Authority and assigns CVEs to most bug fixes, which has multiplied the number of kernel CVEs and makes CVE counts a poor measure of risk for distributions and appliances. The kernel should not be confused with the whole operating system: shells, system libraries, the init system and user-space services are outside it, and a GNU/Linux distribution or Windows edition bundles a kernel with all of those.","da":"Kernens autoritet kommer fra CPU'ens privilegieniveauer. På x86 kører den i ring 0 (supervisor mode) og brugerprogrammer i ring 3; på ARMv8 svarer det til EL1 og EL0 med hypervisorer på EL2. Kun privilegeret kode må ændre sidetabeller, maskere interrupts, tilgå I/O-porte eller omkonfigurere CPU'en, så brugerrummet må krydse grænsen via et kontrolleret indgangspunkt: på x86-64 springer instruktionen syscall til en adresse, kernen har lagt i det modelspecifikke register LSTAR; kernen validerer argumenterne, kopierer data over med særlige hjælpefunktioner (copy_from_user i Linux), udfører arbejdet og vender tilbage. Interrupts og undtagelser som sidefejl går ind i kernen på samme måde. Hvert systemkald er derfor en tillidsgrænse, og de fleste kernesårbarheder er hukommelsesfejl i kode, der fortolker data fra brugerrummet eller fra enheder.\n\nArkitekturerne adskiller sig ved, hvor meget der kører i det privilegerede rum. Linux er monolitisk: scheduler, hukommelsesstyring, filsystemer, netværksstak og drivere kører alle i ring 0 i ét adresserum og kan udvides under kørsel med indlæselige moduler. Mikrokerner som seL4 eller QNX holder kun adresserum, tråde og kommunikation mellem processer i kernen og skubber drivere og filsystemer ud i servere i brugerrummet, hvilket bytter ydeevne for isolation; seL4 er kendt for et maskinelt kontrolleret bevis for funktionel korrekthed. Windows NT og Apples XNU beskrives normalt som hybrider, men kører i praksis de fleste drivere i kernetilstand.\n\nDet er den største sikkerhedssvaghed: enhver driver i kernetilstand har fuld magt. Angribere udnytter det med bring-your-own-vulnerable-driver (indlæsning af en legitimt signeret, men fejlbehæftet driver for at få ring 0-adgang og slå EDR ned), og forsvarerne så bagsiden i hændelser som CrowdStrike Falcon-opdateringen den 19. juli 2024, hvor en fejlbehæftet indholdsfil, der blev behandlet af en kernedriver, fik ca. 8,5 millioner Windows-maskiner til at gå ned. Modtræk omfatter obligatorisk driversignering og Microsofts blokeringsliste over sårbare drivere, virtualiseringsbaseret sikkerhed (HVCI, \"hukommelsesintegritet\"), KASLR, SMEP og SMAP (der forhindrer kernen i uventet at udføre eller tilgå brugersider), isolation af kernens sidetabeller indført efter Meltdown i 2018 og i Linux eBPF som en verificeret sandkasse i kernen, så overvågningsværktøjer ikke behøver egne moduler. Rust er nu accepteret til nye drivere i Linux-kernen.\n\nDriftsmæssigt kræver en kerneopdatering normalt genstart, fordi det kørende image ikke bare kan udskiftes; live patching (kpatch, Livepatch, Windows hotpatch på understøttede udgaver) lægger begrænsede rettelser på funktionsniveau ind i hukommelsen. Siden februar 2024 har Linux-kerneprojektet været sin egen CVE Numbering Authority og tildeler CVE'er til de fleste fejlrettelser, hvilket har mangedoblet antallet af kerne-CVE'er og gør antallet af CVE'er til et dårligt mål for risiko i distributioner og appliances. Kernen må ikke forveksles med hele styresystemet: shells, systembiblioteker, init-systemet og tjenester i brugerrummet ligger uden for den, og en GNU/Linux-distribution eller en Windows-udgave samler en kerne med alt dette."},"edges":[{"type":"part-of","to":"cs/operating-system","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/permission","why":{"en":"The kernel is what actually checks permissions each time a program asks to do something.","da":"Det er kernen, der rent faktisk tjekker rettigheder, hver gang et program beder om at gøre noget."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/process","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Operating Systems: Three Easy Pieces","url":"https://pages.cs.wisc.edu/~remzi/OSTEP/","tier":"textbook","publisher":"Arpaci-Dusseau"},{"title":"Modern Operating Systems","tier":"textbook","publisher":"Tanenbaum & Bos (Pearson)"}],"draft":true}