Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1566512
| From | Laura Abbott <labbott@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA |
| Date | 2017-01-25 12:30 +0100 |
| Message-ID | <t3tW2-16w-29@gated-at.bofh.it> (permalink) |
| References | <t19RM-3iT-5@gated-at.bofh.it> <t19RM-3iT-3@gated-at.bofh.it> <t1fNv-77q-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On 01/19/2017 08:53 AM, Pavel Machek wrote: > On Wed 2017-01-18 17:29:05, Laura Abbott wrote: >> >> Despite the word 'debug' in CONFIG_DEBUG_RODATA, this kernel option >> provides key security features that are to be expected on a modern >> system. Change the name to CONFIG_HARDENED_PAGE_MAPPINGS which more >> accurately describes what this option is intended to do. > > I think this is bad change. CONFIG_DEBUG_RODATA is describing what it > does, CONFIG_HARDENED_PAGE_MAPPINGS is advertising. > > We don't do advertising, and we don't force people to re-answer the > config questions without good reason. > > CONFIG_HARDENED_RODATA might fix the first problem, but not the second > one. > > Pavel > (Apologies, my SMTP was set up incorrectly so my response didn't actually get sent out) CONFIG_DEBUG_RODATA isn't describing what it does though. It misses that this config may handle much more than just rodata. I think Mark Rutland's suggestion of STRICT_KERNEL_RWX might be more descriptive. Thanks, Laura
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-19 02:40 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Pavel Machek <pavel@ucw.cz> - 2017-01-19 09:00 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:30 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Pavel Machek <pavel@ucw.cz> - 2017-01-25 15:00 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Mark Rutland <mark.rutland@arm.com> - 2017-01-19 12:00 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-01-19 12:40 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Helge Deller <deller@gmx.de> - 2017-01-19 22:20 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:40 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Kees Cook <keescook@chromium.org> - 2017-01-19 23:10 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Laura Abbott <labbott@redhat.com> - 2017-01-25 12:30 +0100
Re: [PATCH 1/2] security: Change name of CONFIG_DEBUG_RODATA Kees Cook <keescook@chromium.org> - 2017-01-19 23:10 +0100
csiph-web