Feature: Downgrading Linux Kernel

[pyukey]

Difficulty: 10/10

There are certain vulnerabilities that are specific to a kernel version (e.g. Dirty COW). It would be cool if there was a system in place that allowed the machine's kernel to be downgraded to a specific version, so that these vulnerabilities can be tested.

Since the kernel is open source, this likely involves downloading the old kernel version and booting that, but idk how to automate that.

[Tetrago]

There should probably be some ground rules for this, since it can become quite complicated. Every distro handles this slightly differently.

• What distros should be prioritized?
• Should a default installation be expected (standard partition layout)?
• Should it be reversible?
• Should the new kernel become the default kernel or just a boot option?
• Is it expected that we're in a VM (so we can compile less modules)?

[pyukey]

To answer your questions:

• What distros should be prioritized? Debian, as that is the most common distro in competitions. Would be nice to also work for a RHEL-based distro (e.g. CentOS). The original goal of BlueDaBaDee is to be as compatible as possible so that it would work for any distro, but I'd understand if that's not possible for something as nuanced as downgrading the kernel.
• Is it expected that we're in a VM? Absolutely. BlueDaBaDee is only meant for VM practice environments.
• Should a default installation be expected? I think so. Imagine someone booted a fresh VM
• Should it be reversible? Yes it should be. The goal of BlueDaBaDee is that the user can practice patching these vulnerabilities. Later on we'll make slides + videos explaining how to reverse these changes.

[Tetrago]

Took a crack at writing a generic kernel compilation script, but I don't think that's going to be feasible for what we want to accomplish. Even ignoring the distro specific kernel branches and config, just compiling the base kernel requires rather significant changes on each kernel version.

I think the approach to use going forward would be to fetch the precompiled kernel images made available in the appropriate distro package repository. This does limit compatibility somewhat, but since we were already going to need distro-specific logic to handle installing it anyways, this might be the best option.