Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1673796

Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time

Show all headers | View raw

On Fri, Jun 23, 2017 at 7:06 AM, Michal Hocko <mhocko@kernel.org> wrote:
> On Tue 20-06-17 16:09:11, Kees Cook wrote:
>> Some hardened environments want to build kernels with slab_nomerge
>> already set (so that they do not depend on remembering to set the kernel
>> command line option). This is desired to reduce the risk of kernel heap
>> overflows being able to overwrite objects from merged caches and changes
>> the requirements for cache layout control, increasing the difficulty of
>> these attacks. By keeping caches unmerged, these kinds of exploits can
>> usually only damage objects in the same cache (though the risk to metadata
>> exploitation is unchanged).
>
> Do we really want to have a dedicated config for each hardening specific
> kernel command line? I believe we have quite a lot of config options
> already. Can we rather have a CONFIG_HARDENED_CMD_OPIONS and cover all
> those defauls there instead?

There's not been a lot of success with grouped Kconfigs in the past
(e.g. CONFIG_EXPERIMENTAL), but one thing that has been suggested is a
defconfig-like make target that would collect all the things together.
I haven't had time for that, but that would let us group the various
configs.

Additionally, using something like CONFIG_CMDLINE seems a little clunky to me.

-Kees

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2] mm: Allow slab_nomerge to be set at build time Kees Cook <keescook@chromium.org> - 2017-06-21 01:10 +0200
  Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time Randy Dunlap <rdunlap@infradead.org> - 2017-06-21 01:20 +0200
    Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time Kees Cook <keescook@chromium.org> - 2017-06-21 01:30 +0200
      Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time Randy Dunlap <rdunlap@infradead.org> - 2017-06-21 02:10 +0200
  Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time Michal Hocko <mhocko@kernel.org> - 2017-06-23 16:10 +0200
    Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time Kees Cook <keescook@chromium.org> - 2017-06-23 21:30 +0200
      Re: [PATCH v2] mm: Allow slab_nomerge to be set at build time Michal Hocko <mhocko@kernel.org> - 2017-06-26 11:10 +0200

csiph-web