Is Zircon kernel (from Fuchsia OS) safer by being a microkernel?

Question

Fuchsia's possible Android replacement uses the Zircon microkernel. This means that the drivers should run in userspace.

Is this an advantage over Android? For example, closed source drivers now can't do anything they want with the kernel. They can't read/write to arbitrary memory areas, except of course by using an exploit.

This drastically reduces the chances of backdoors. For example, a driver for a WiFi device can of course still hide a backdoor for accepting connections from some magic address, but it cannot use this backdoor to alter some process state for example.

Am I right?

Answer 1

Microkernels are safer in theory as individual drivers run in userspace, but there's absolutely no way to know if a specific microkernel is more secure than any other kernel without testing it. All that we can say for sure is that the microkernel architecture makes it easier to protect against malicious or insecure drivers, and it makes it easier to move kernel code out of the trusted computing base.

Kernel hacker Alexander Popov recently looked into the security of Zircon. His notes are interesting.

Answer 2

Taking a look at the default security mitigations present in zircon kernel

• ASLR
• Data Execution Prevention (DEP)
• SafeStack
• ShadowCallStack
• AutovarInt

Which is alot compared to normal Linux kernel that we see. Your other question

but it cannot use this backdoor to alter some process state for example.

Fuschia os implements devhosts devhosts. A devhost is a process that contains several layers of a driver stack. To alter some process state which will be in the same devhost. The components can use IPC to communicate with other components which are exposed in /svc

Surely i think its a great advantage even if there is a backdoor on a wifi driver it will only be affected inside the component and doesn't affect other components or the kernel