linux-kernel - Re: [PATCH] VFS: add config options to enable link restrictions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFzw_p-WJyBBGc5UFDU8yN698REH+Vc1fk=CDeq4JG8AFA@mail.gmail.com>
Date:	Fri, 26 Oct 2012 13:12:12 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Kees Cook <keescook@...omium.org>
Cc:	linux-kernel@...r.kernel.org,
	Alexander Viro <viro@...iv.linux.org.uk>,
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] VFS: add config options to enable link restrictions

On Fri, Oct 26, 2012 at 12:46 PM, Kees Cook <keescook@...omium.org> wrote:
>
> I think there's value in being able to enable these protections at
> build-time so there's no need for a distro to have to ship extra
> files/lines, spend time setting it, etc.

The "value in not having to change the distro" is valid value. That
said, two lines to rc.local does that too.

But dammit, every single discussion I see, you use some *other*
argument for it, like "people don't have initrd" or whatever crazy
crap. That's what I was objecting to.

> Would a single config item be acceptable? What would be an agreeable
> way to enable this at build-time?

I dunno. Maybe a CONFIG_LOCKDOWN thing that sets a few of our other
default values as well. Or at least hide the config options from
normal users behind some extra security menu, so that people just
don't have to care this deeply. Because most people *don't* care.

I also don't see why it would be a build-time config option at all.
Why not just expose them as option using module_param_named(), and
then you can do it in the kernel command flags (and set it in your
grub.conf etc).

            Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/