Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1217870
| From | Stas Sergeev <stsp@list.ru> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') |
| Date | 2015-09-02 23:50 +0200 |
| Message-ID | <q4o4P-yd-23@gated-at.bofh.it> (permalink) |
| References | (4 earlier) <q4mPo-7io-9@gated-at.bofh.it> <q4n8J-7EF-5@gated-at.bofh.it> <q4niq-7PZ-9@gated-at.bofh.it> <q4ns6-8gJ-9@gated-at.bofh.it> <q4o4O-yd-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
03.09.2015 00:40, Andy Lutomirski пишет: > On Wed, Sep 2, 2015 at 2:12 PM, Stas Sergeev <stsp@list.ru> wrote: >> 02.09.2015 23:55, Andy Lutomirski пишет: >> >>> On Wed, Sep 2, 2015 at 1:47 PM, Stas Sergeev <stsp@list.ru> wrote: >>>> 02.09.2015 23:22, Josh Boyer пишет: >>>>> On Wed, Sep 2, 2015 at 1:50 PM, Stas Sergeev <stsp@list.ru> wrote: >>>>>> 02.09.2015 20:46, Josh Boyer пишет: >>>>>>> On Wed, Sep 2, 2015 at 10:08 AM, Andy Lutomirski <luto@amacapital.net> >>>>>>> wrote: >>>>>>>> I'd be amenable to switching the default back to y and perhaps adding >>>>>>>> a sysctl to make the distros more comfortable. Ingo, Kees, Brian, >>>>>>>> what do you think? >>>>>>> Can you please leave the default as N, and have a sysctl option to >>>>>>> enable it instead? While dosemu might still be in use, it isn't going >>>>>>> to be the common case at all. So from a distro perspective, I think >>>>>>> we'd probably rather have the default match the common case. >>>>>> The fact that fedora doesn't package dosemu, doesn't automatically >>>>>> mean all other distros do not too. Since when kernel defaults should >>>>>> match the ones of fedora? >>>>> I didn't say that. >>>> What you said was: >>>> --- >>>> >>>> While dosemu might still be in use, it isn't going >>>> to be the common case at all. So from a distro perspective >>>> >>>> --- >>>> ... which is likely true only in fedora circe. >>>> >>>>> The default right now is N. >>>> In a not yet released kernel, unless I am mistaken. >>>> If fedora already provides that kernel, other distros likely not. >>>> >>>>> I asked it be left >>>>> that way. That's all. >>>> Lets assume its not yet N, unless there was a kernel release already. >>>> Its easy to get back if its not too late. >>> How about CONFIG_SYSCTL_VM86_DEFAULT which defaults to Y? Fedora >>> could set it to N. >> Sorry, I don't understand this sysctl proposal. >> Could you please educate me what is it all about? >> This sysctl will disable or enable the vm86() syscall at run-time, >> right? What does it give us? If you disable something in the >> config, this gives you, say, smaller kernel image. If OTOH you >> add the run-time switch, it gives you a bigger image, regardless >> of its default value. >> I might be missing something, but I don't understand what >> problem will this solve? Have I missed some earlier message >> in this thread? > For the 99%+ of users who don't use dosemu, it prevents exploits that > target vm86 from attacking their kernel. I don't think the attack scenario was satisfactory explained. IIRC you only said that --- The mark_screen_rdonly thing is still kind of scary. It changes PTEs on arbitrary mappings behind the vm's back. --- Just go ahead and remove mark_screen_rdonly, big deal. Is this all of the threat? Or do we treat _every_ syscall as the potential attack target? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 11:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 16:10 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Kees Cook <keescook@chromium.org> - 2015-09-02 17:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 19:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 19:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 20:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 22:30 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 22:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 23:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 23:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 23:10 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 23:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-02 23:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 14:20 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 14:20 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 17:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 18:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 21:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 23:30 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Chuck Ebbert <cebbert.lkml@gmail.com> - 2015-09-04 12:10 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 12:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-04 14:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 15:10 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-04 22:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 23:20 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 23:30 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Raymond Jennings <shentino@gmail.com> - 2015-09-05 00:50 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-05 01:20 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-04 00:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Linus Torvalds <torvalds@linux-foundation.org> - 2015-09-03 19:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-03 19:30 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 19:40 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 19:30 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 19:20 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Stas Sergeev <stsp@list.ru> - 2015-09-03 14:10 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-03 14:10 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Kees Cook <keescook@chromium.org> - 2015-09-02 20:00 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 22:30 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Andy Lutomirski <luto@amacapital.net> - 2015-09-02 20:20 +0200
Re: stop breaking dosemu (Re: x86/kconfig/32: Rename CONFIG_VM86 and default it to 'n') Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-02 22:30 +0200
csiph-web