Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1371717 > unrolled thread
| Started by | Joerg Roedel <joro@8bytes.org> |
|---|---|
| First post | 2016-04-05 17:30 +0200 |
| Last post | 2016-04-06 00:50 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS Joerg Roedel <joro@8bytes.org> - 2016-04-05 17:30 +0200
Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS Steven Rostedt <rostedt@goodmis.org> - 2016-04-05 18:40 +0200
Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS Joerg Roedel <joro@8bytes.org> - 2016-04-06 00:50 +0200
| From | Joerg Roedel <joro@8bytes.org> |
|---|---|
| Date | 2016-04-05 17:30 +0200 |
| Subject | Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS |
| Message-ID | <rkB5w-5V6-13@gated-at.bofh.it> |
On Sat, Mar 26, 2016 at 09:18:44PM -0400, Paul Gortmaker wrote: > We have at least one big banner telling people that they should > not deploy production kernels with DEBUG options enabled, but > at the same time, we make it hard for people to turn DEBUG_FS > off when we select (vs. depend on) the CONFIG_DEBUG_FS option. > > Since we actively discourage people using debug-like features > on any builds that are production oriented (see trace_printk > banner for one example), so a generic sounding option should > not select DEBUG_FS. That reasoning sounds a bit odd, as most production kernels have DEBUG_FS enabled anyway, and I see no problem with that. Disabling all debug features in 'production kernels' is a bit overkill. Only if the feature has any runtime impact (performance, memory consumption, security, ...) it makes sense to disable it for production kernels. Other features could stay enabled, and DEBUG_FS is one of them. For some debug features we even don't offer a way to disable them, see BUG_ON, WARN_ON and friends. Joerg
[toc] | [next] | [standalone]
| From | Steven Rostedt <rostedt@goodmis.org> |
|---|---|
| Date | 2016-04-05 18:40 +0200 |
| Subject | Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS |
| Message-ID | <rkCbf-6W6-9@gated-at.bofh.it> |
| In reply to | #1371717 |
On Tue, 5 Apr 2016 17:19:51 +0200 Joerg Roedel <joro@8bytes.org> wrote: > On Sat, Mar 26, 2016 at 09:18:44PM -0400, Paul Gortmaker wrote: > > We have at least one big banner telling people that they should > > not deploy production kernels with DEBUG options enabled, but > > at the same time, we make it hard for people to turn DEBUG_FS > > off when we select (vs. depend on) the CONFIG_DEBUG_FS option. > > > > Since we actively discourage people using debug-like features > > on any builds that are production oriented (see trace_printk > > banner for one example), so a generic sounding option should > > not select DEBUG_FS. > > That reasoning sounds a bit odd, as most production kernels have > DEBUG_FS enabled anyway, and I see no problem with that. > > Disabling all debug features in 'production kernels' is a bit overkill. > Only if the feature has any runtime impact (performance, memory > consumption, security, ...) it makes sense to disable it for production > kernels. > > Other features could stay enabled, and DEBUG_FS is one of them. For some > debug features we even don't offer a way to disable them, see BUG_ON, > WARN_ON and friends. > I will argue that people have asked me to move tracing out of debugfs (which is why I created tracefs) because the problem with debugfs is that it opens up a entire system that is not well scrutinized, and holds lots of possible ways to crack the kernel. Disabling debugfs does help with the "security" point you mentioned above. -- Steve
[toc] | [prev] | [next] | [standalone]
| From | Joerg Roedel <joro@8bytes.org> |
|---|---|
| Date | 2016-04-06 00:50 +0200 |
| Message-ID | <rkHXk-2Aa-19@gated-at.bofh.it> |
| In reply to | #1371778 |
On Tue, Apr 05, 2016 at 12:37:54PM -0400, Steven Rostedt wrote: > I will argue that people have asked me to move tracing out of debugfs > (which is why I created tracefs) because the problem with debugfs is > that it opens up a entire system that is not well scrutinized, and > holds lots of possible ways to crack the kernel. > > Disabling debugfs does help with the "security" point you mentioned > above. Yes, that reasoning makes more sense than "debug features are bad for production". It should've been part of the commit message. The AMD_IOMMU_STATS feature is on my list of things to remove anyway, it is mostly disabled and should be done differently (via per-device sysfs stats). So I am just going to remove it for now. Joerg
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web