Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1566512

Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA

From Laura Abbott <labbott@redhat.com>
Newsgroups linux.kernel
Subject Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA
Date 2017-01-25 12:30 +0100
Message-ID <t3tW2-16w-29@gated-at.bofh.it> (permalink)
References <t19RM-3iT-5@gated-at.bofh.it> <t19RM-3iT-3@gated-at.bofh.it> <t1fNv-77q-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


On 01/19/2017 08:53 AM, Pavel Machek wrote:
> On Wed 2017-01-18 17:29:05, Laura Abbott wrote:
>>
>> Despite the word 'debug' in CONFIG_DEBUG_RODATA, this kernel option
>> provides key security features that are to be expected on a modern
>> system. Change the name to CONFIG_HARDENED_PAGE_MAPPINGS which more
>> accurately describes what this option is intended to do.
>
> I think this is bad change. CONFIG_DEBUG_RODATA is describing what it
> does, CONFIG_HARDENED_PAGE_MAPPINGS is advertising.
>
> We don't do advertising, and we don't force people to re-answer the
> config questions without good reason.
>
> CONFIG_HARDENED_RODATA might fix the first problem, but not the second
> one.
>
> 								Pavel
> 								

(Apologies, my SMTP was set up incorrectly so my response didn't
actually get sent out)

CONFIG_DEBUG_RODATA isn't describing what it does though. It misses
that this config may handle much more than just rodata. I think
Mark Rutland's suggestion of STRICT_KERNEL_RWX might be more
descriptive.

Thanks,
Laura

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-19 02:40 +0100
  Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Pavel Machek <pavel@ucw.cz> - 2017-01-19 09:00 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:30 +0100
      Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Pavel Machek <pavel@ucw.cz> - 2017-01-25 15:00 +0100
  Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Mark Rutland <mark.rutland@arm.com> - 2017-01-19 12:00 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-01-19 12:40 +0100
      Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Helge Deller <deller@gmx.de> - 2017-01-19 22:20 +0100
      Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:40 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Kees Cook <keescook@chromium.org> - 2017-01-19 23:10 +0100
    Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:30 +0100
  Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Kees Cook <keescook@chromium.org> - 2017-01-19 23:10 +0100

csiph-web