Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS

From	Steven Rostedt <rostedt@goodmis.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS
Date	2016-04-05 18:40 +0200
Message-ID	<rkCbf-6W6-9@gated-at.bofh.it> (permalink)
References	<rh7x0-Ue-3@gated-at.bofh.it> <rkB5w-5V6-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, 5 Apr 2016 17:19:51 +0200
Joerg Roedel <joro@8bytes.org> wrote:

> On Sat, Mar 26, 2016 at 09:18:44PM -0400, Paul Gortmaker wrote:
> > We have at least one big banner telling people that they should
> > not deploy production kernels with DEBUG options enabled, but
> > at the same time, we make it hard for people to turn DEBUG_FS
> > off when we select (vs. depend on) the CONFIG_DEBUG_FS option.
> > 
> > Since we actively discourage people using debug-like features
> > on any builds that are production oriented (see trace_printk
> > banner for one example), so a generic sounding option should
> > not select DEBUG_FS.  
> 
> That reasoning sounds a bit odd, as most production kernels have
> DEBUG_FS enabled anyway, and I see no problem with that.
> 
> Disabling all debug features in 'production kernels' is a bit overkill.
> Only if the feature has any runtime impact (performance, memory
> consumption, security, ...) it makes sense to disable it for production
> kernels.
> 
> Other features could stay enabled, and DEBUG_FS is one of them. For some
> debug features we even don't offer a way to disable them, see BUG_ON,
> WARN_ON and friends.
> 

I will argue that people have asked me to move tracing out of debugfs
(which is why I created tracefs) because the problem with debugfs is
that it opens up a entire system that is not well scrutinized, and
holds lots of possible ways to crack the kernel.

Disabling debugfs does help with the "security" point you mentioned
above.

-- Steve

Thread

Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS Joerg Roedel <joro@8bytes.org> - 2016-04-05 17:30 +0200
  Re: [PATCH] drivers/iommu: don't select DEBUG_FS for  AMD_IOMMU_STATS Steven Rostedt <rostedt@goodmis.org> - 2016-04-05 18:40 +0200
    Re: [PATCH] drivers/iommu: don't select DEBUG_FS for AMD_IOMMU_STATS Joerg Roedel <joro@8bytes.org> - 2016-04-06 00:50 +0200

csiph-web