linux-kernel - Re: [PATCH] CMA: Do no enable it by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFxu9ZfbKuWdhmADreRS9wxzMyW9buoVkd=B4Yqi=bxbiw@mail.gmail.com>
Date:	Tue, 5 Jun 2012 09:46:49 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Borislav Petkov <bp@...64.org>
Cc:	Christopher Yeoh <cyeoh@....ibm.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Randy Dunlap <rdunlap@...otime.net>
Subject: Re: [PATCH] CMA: Do no enable it by default

On Tue, Jun 5, 2012 at 4:05 AM, Borislav Petkov <bp@...64.org> wrote:
>
> Besides, in the config option it says "... which allow a process with
> the correct privileges to directly read from or write to to another
> process's address space.", which, if the reading process has somehow
> gained privileges (as that never happens) is your security issue right
> there.

What?

It's using the same privileges as ptrace. If you are allowed to ptrace
somebody, there's no security issue.

Also, the reason it's "default y" is that the feature actually made it
in earlier (with no config option at all). Now, I certainly agree that
we could turn it off by default since it's not that common, but at the
same time none of your actual commit comments make sense, so that
would have to be fixed first.

            Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/