linux-kernel - Re: [patch 2/3] MAP_NOZERO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20070630005200.27d71cc4.akpm@linux-foundation.org>
Date:	Sat, 30 Jun 2007 00:52:00 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Nicholas Miell <nmiell@...cast.net>
Cc:	Davide Libenzi <davidel@...ilserver.org>,
	Hugh Dickins <hugh@...itas.com>,
	Ulrich Drepper <drepper@...il.com>, blaisorblade@...oo.it,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [patch 2/3] MAP_NOZERO - implement sys_brk2()

On Wed, 27 Jun 2007 15:11:49 -0700 Nicholas Miell <nmiell@...cast.net> wrote:

> I don't think the security issues with this will ever make it
> worthwhile.

eh, security issues are a corner case.

The vast majority of Linux machines are used by a single user who has admin
access anyway.  This includes all embedded, all consumer and most laptop
and desktop.

So a reasonable way of getting the benefit of this change into most
people's hands is to forget about the uid/euid issues altogether and just
have a big fat knob which enables this feature, system-wide.  (Radical,
huh.   But then, I liked single user linux.)

A significant problem I see with any such approach is that it yet again
weakens the overall testing and QA effort: libc and the kernel now need to
be tested with and without this feature, and it's yet another question to
be asked of the bug reporters.

(But please take none of this as endorsement.  For some reason the whole
thing gives me the creepies).

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/