linux-hardening - Re: KFENCE: included in x86 defconfig?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 09 Feb 2024 22:25:11 -0800
From: Kees Cook <kees@...nel.org>
To: Marco Elver <elver@...gle.com>, Matthieu Baerts <matttbe@...nel.org>
CC: Alexander Potapenko <glider@...gle.com>, Dmitry Vyukov <dvyukov@...gle.com>,
 kasan-dev@...glegroups.com, Netdev <netdev@...r.kernel.org>,
 Jakub Kicinski <kuba@...nel.org>, linux-hardening@...r.kernel.org,
 Kees Cook <keescook@...omium.org>, the arch/x86 maintainers <x86@...nel.org>
Subject: Re: KFENCE: included in x86 defconfig?

On February 7, 2024 10:05:31 AM PST, Marco Elver <elver@...gle.com> wrote:
>On Wed, 7 Feb 2024 at 17:16, Matthieu Baerts <matttbe@...nel.org> wrote:
>[...]
>> When talking to Jakub about the kernel config used by the new CI for the
>> net tree [1], Jakub suggested [2] to check if KFENCE could not be
>> enabled by default for x86 architecture.
>
>I think this would belong into some "hardening" config - while KFENCE
>is not a mitigation (due to sampling) it has the performance
>characteristics of unintrusive hardening techniques, so I think it
>would be a good fit. I think that'd be
>"kernel/configs/hardening.config".

I would be happy to see it added to the hardening fragment! Send me a patch and I'll put it in my tree. :)

-Kees

-- 
Kees Cook