Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA

Path	csiph.com!goblin2!goblin.stu.neva.ru!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	Laura Abbott <labbott@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA
Date	Wed, 25 Jan 2017 12:30:02 +0100
Message-ID	<t3tW2-16w-21@gated-at.bofh.it> (permalink)
References	<t19RM-3iT-5@gated-at.bofh.it> <t19RM-3iT-3@gated-at.bofh.it> <t1iBJ-uk-37@gated-at.bofh.it>
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=ElSoVZqz/Gvh0tMOeUEwYxzvPmZbxdJ91D61tWqsPEw=; b=n5/iFmrPcdER8K+JNna6nWWe/55iNGPgSVMx2RjWebprucGPhmq7fMEVWvGz2BwLmq VxllC/Uf6i3nSsJSQ/JmRI5JcGdU5i6xJtT3T5JqIUXYOb5FJP2A1dCfQU4n4Nq4bb7t 0uTX1xl7SAKc7K6/9W3tb4lCxHXOjZzpnSwXvD+09y/qlEXLS8Z2U1NcT7jSjDPxzyO0 CTK/WY4NSV4VM0+GwlnnpO3mgfVRdEom/mt3Ry395dvYpNW0IUeT8EowQZR6K10d5o30 +RfZGNkEhwRoIqy6woHEMGCm14gi61uNl7/aYbhwzMTzayWC7pPausSzTn9AEIjRFKhP Huhw==
X-Gm-Message-State	AIkVDXL+PWgRyTSAz/zpNKtm4Mr3iFGqGwc7kjyQ2nKTomArqOsCLKkZHXqLlSrQEk0OKC8W
X-Received	by 10.37.96.67 with SMTP id u64mr3603869ybb.12.1485343511944; Wed, 25 Jan 2017 03:25:11 -0800 (PST)
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0
MIME-Version	1.0
Content-Type	text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding	7bit
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	29
Organization	linux.* mail to news gateway
X-Original-Cc	Kees Cook <keescook@chromium.org>, Jason Wessel <jason.wessel@windriver.com>, Jonathan Corbet <corbet@lwn.net>, Russell King <linux@armlinux.org.uk>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will.deacon@arm.com>, "James E.J. Bottomley" <jejb@parisc-linux.org>, Helge Deller <deller@gmx.de>, Martin Schwidefsky <schwidefsky@de.ibm.com>, Heiko Carstens <heiko.carstens@de.ibm.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>, x86@kernel.org, Rob Herring <robh@kernel.org>, "Rafael J. Wysocki" <rjw@rjwysocki.net>, Len Brown <len.brown@intel.com>, Pavel Machek <pavel@ucw.cz>, Jessica Yu <jeyu@redhat.com>, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-parisc@vger.kernel.org, linux-s390@vger.kernel.org, linux-pm@vger.kernel.org, kernel-hardening@lists.openwall.com
X-Original-Date	Wed, 25 Jan 2017 12:25:03 +0100
X-Original-Message-ID	<4116b91a-4fb5-414d-5fd5-36be151c600c@redhat.com>
X-Original-References	<1484789346-21012-1-git-send-email-labbott@redhat.com> <1484789346-21012-2-git-send-email-labbott@redhat.com> <20170119105646.GA11176@leverpostej>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1566514

Show key headers only | View raw

On 01/19/2017 11:56 AM, Mark Rutland wrote:
> Hi Laura,
>
> On Wed, Jan 18, 2017 at 05:29:05PM -0800, Laura Abbott wrote:
>>
>> Despite the word 'debug' in CONFIG_DEBUG_RODATA, this kernel option
>> provides key security features that are to be expected on a modern
>> system. Change the name to CONFIG_HARDENED_PAGE_MAPPINGS which more
>> accurately describes what this option is intended to do.
>
> This generally sounds good. Thanks for attacking this!
>
> On the bikeshedding front, *maybe* it would be nice to mention
> permissions in the name, something like STRICT_KERNEL_RWX. That might
> also prevent the reading of 'hardened' as 'optional overhead'.
>
> That said, the proposed name is fine by me -- I'm happy so long as
> 'DEBUG' goes.
>

(Apologies for the delay, my SMTP was set up incorrectly so my
messages didn't actually get sent out)

I like that better since it's describing specifically what the config
should be setting as opposed to something more vague. That might fit
better with what Pavel was suggesting as well.

Thanks,
Laura

Thread

[PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-19 02:40 +0100
  Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Pavel Machek <pavel@ucw.cz> - 2017-01-19 09:00 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:30 +0100
      Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Pavel Machek <pavel@ucw.cz> - 2017-01-25 15:00 +0100
  Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Mark Rutland <mark.rutland@arm.com> - 2017-01-19 12:00 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-01-19 12:40 +0100
      Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Helge Deller <deller@gmx.de> - 2017-01-19 22:20 +0100
      Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:40 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Kees Cook <keescook@chromium.org> - 2017-01-19 23:10 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:30 +0100
  Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Kees Cook <keescook@chromium.org> - 2017-01-19 23:10 +0100

csiph-web