linux-hardening - Re: [PATCH] configs/debug: Refresh debug config dependencies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202504221044.98A9CEFD2@keescook>
Date: Tue, 22 Apr 2025 10:52:28 -0700
From: Kees Cook <kees@...nel.org>
To: Matthieu Baerts <matttbe@...nel.org>
Cc: Jakub Kicinski <kuba@...nel.org>,
	Masahiro Yamada <masahiroy@...nel.org>,
	Simon Horman <horms@...nel.org>,
	Anshuman Khandual <anshuman.khandual@....com>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Lukas Bulwahn <lukas.bulwahn@...il.com>,
	Borislav Petkov <bp@...e.de>,
	Nicolas Schier <nicolas.schier@...ux.dev>,
	Michael Ellerman <mpe@...erman.id.au>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Joel Fernandes (Google)" <joel@...lfernandes.org>,
	linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org,
	kunit-dev@...glegroups.com
Subject: Re: [PATCH] configs/debug: Refresh debug config dependencies

On Tue, Apr 22, 2025 at 07:15:44PM +0200, Matthieu Baerts wrote:
> Hi Kees,
> 
> Thank you for sharing this patch!
> 
> On 22/04/2025 18:54, Kees Cook wrote:
> > Many of the CONFIG_DEBUG* options need CONFIG_DEBUG_KERNEL=y to be set,
> 
> Good point! I guess it has not been seen before because it is usually
> enabled in the different _defconfig files. So probably no need to
> backport this I guess, right?
> 
> 
> > so enable it explicitly. Similarly for CONFIG_NET* options, enable
> > CONFIG_NET=y.
> 
> I'm not sure about that one: if I'm not mistaken, the net debugging
> options have been added for CIs using network features, to find bugs in
> this area. In other words, I don't think it is needed to add a
> dependence to CONFIG_NET. If it is enabled, then some extra debugging
> options should be enabled to get more debug. If not, no need to force
> having CONFIG_NET, no?
> 
> (On the other hand, CONFIG_NET is very likely needed for a CI, and it is
> typically enabled in the different _defconfig and kvm_guest.config. I
> guess adding this dependence will very likely not annoy anybody, so up
> to you :) )

Thanks for making me double-check this... it seems what was missing was
defconfig. :P

I noticed all of these from trying to run kunit like this:

$ ./tools/testing/kunit/kunit.py run --arch=x86_64 \
	--kunitconfig kernel/configs/debug.config \
	fortify

But it seems I need something closer to:

$ ./tools/testing/kunit/kunit.py run --arch=x86_64 \
	--kunitconfig arch/x86/configs/x86_64_defconfig \
	--kunitconfig kernel/configs/debug.config \
	fortify

> > Finally, remove CONFIG_DEBUG_VM_VMACACHE, since it was
> > removed in commit 7964cf8caa4d ("mm: remove vmacache").
> 
> Good catch!

Thanks! I'll nail this down a bit more and send a v2.

-- 
Kees Cook