Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n')

From	Andy Lutomirski <luto@amacapital.net>
Newsgroups	linux.kernel
Subject	Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n')
Date	2015-09-02 23:50 +0200
Message-ID	<q4o4O-yd-3@gated-at.bofh.it> (permalink)
References	(3 earlier) <q4kue-3Oz-9@gated-at.bofh.it> <q4mPo-7io-9@gated-at.bofh.it> <q4n8J-7EF-5@gated-at.bofh.it> <q4niq-7PZ-9@gated-at.bofh.it> <q4ns6-8gJ-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Sep 2, 2015 at 2:12 PM, Stas Sergeev <stsp@list.ru> wrote:
> 02.09.2015 23:55, Andy Lutomirski пишет:
>
>> On Wed, Sep 2, 2015 at 1:47 PM, Stas Sergeev <stsp@list.ru> wrote:
>>>
>>> 02.09.2015 23:22, Josh Boyer пишет:
>>>>
>>>> On Wed, Sep 2, 2015 at 1:50 PM, Stas Sergeev <stsp@list.ru> wrote:
>>>>>
>>>>> 02.09.2015 20:46, Josh Boyer пишет:
>>>>>>
>>>>>> On Wed, Sep 2, 2015 at 10:08 AM, Andy Lutomirski <luto@amacapital.net>
>>>>>> wrote:
>>>>>>>
>>>>>>> I'd be amenable to switching the default back to y and perhaps adding
>>>>>>> a sysctl to make the distros more comfortable.  Ingo, Kees, Brian,
>>>>>>> what do you think?
>>>>>>
>>>>>> Can you please leave the default as N, and have a sysctl option to
>>>>>> enable it instead?  While dosemu might still be in use, it isn't going
>>>>>> to be the common case at all.  So from a distro perspective, I think
>>>>>> we'd probably rather have the default match the common case.
>>>>>
>>>>> The fact that fedora doesn't package dosemu, doesn't automatically
>>>>> mean all other distros do not too. Since when kernel defaults should
>>>>> match the ones of fedora?
>>>>
>>>> I didn't say that.
>>>
>>> What you said was:
>>> ---
>>>
>>> While dosemu might still be in use, it isn't going
>>> to be the common case at all.  So from a distro perspective
>>>
>>> ---
>>> ... which is likely true only in fedora circe.
>>>
>>>>     The default right now is N.
>>>
>>> In a not yet released kernel, unless I am mistaken.
>>> If fedora already provides that kernel, other distros likely not.
>>>
>>>>     I asked it be left
>>>> that way.  That's all.
>>>
>>> Lets assume its not yet N, unless there was a kernel release already.
>>> Its easy to get back if its not too late.
>>
>> How about CONFIG_SYSCTL_VM86_DEFAULT which defaults to Y?  Fedora
>> could set it to N.
>
> Sorry, I don't understand this sysctl proposal.
> Could you please educate me what is it all about?
> This sysctl will disable or enable the vm86() syscall at run-time,
> right? What does it give us? If you disable something in the
> config, this gives you, say, smaller kernel image. If OTOH you
> add the run-time switch, it gives you a bigger image, regardless
> of its default value.
> I might be missing something, but I don't understand what
> problem will this solve? Have I missed some earlier message
> in this thread?

For the 99%+ of users who don't use dosemu, it prevents exploits that
target vm86 from attacking their kernel.

--Andy

-- 
Andy Lutomirski
AMA Capital Management, LLC
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 11:40 +0200
  Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 16:10 +0200
    Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Kees Cook <keescook@chromium.org> - 2015-09-02 17:40 +0200
    Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 19:40 +0200
    Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 19:50 +0200
      Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 20:00 +0200
        Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 22:30 +0200
          Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 22:50 +0200
            Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 23:00 +0200
              Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 23:00 +0200
              Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 23:10 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 23:50 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 23:50 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 14:20 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 14:20 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 17:50 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 18:40 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 21:00 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 23:30 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86  and default it to 'n') Chuck Ebbert <cebbert.lkml@gmail.com> - 2015-09-04 12:10 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 12:50 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-04 14:40 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 15:10 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-04 22:00 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 23:20 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 23:30 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Raymond Jennings <shentino@gmail.com> - 2015-09-05 00:50 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-05 01:20 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 00:40 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Linus Torvalds <torvalds@linux-foundation.org> - 2015-09-03 19:00 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-03 19:30 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 19:40 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 19:30 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 19:20 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 14:10 +0200
                Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 14:10 +0200
      Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Kees Cook <keescook@chromium.org> - 2015-09-02 20:00 +0200
        Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 22:30 +0200
      Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 20:20 +0200
        Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and  default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 22:30 +0200

csiph-web