linux-kernel - Re: [RFC] CONFIG_GENERIC_BOOTABLE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 Jan 2016 12:52:04 -0500
From:	"Austin S. Hemmelgarn" <ahferroin7@...il.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Ingo Molnar <mingo@...nel.org>
Cc:	Michal Marek <mmarek@...e.cz>, Borislav Petkov <bp@...e.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Måns Rullgård <mans@...sr.com>,
	Markus Trippelsdorf <markus@...ppelsdorf.de>,
	Thomas Voegtle <tv@...96.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	x86-ml <x86@...nel.org>, Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Thomas Gleixner <tglx@...utronix.de>,
	Jiri Olsa <jolsa@...hat.com>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Frédéric Weisbecker <fweisbec@...il.com>
Subject: Re: [RFC] CONFIG_GENERIC_BOOTABLE_CONFIG=y

On 2016-01-19 12:22, Linus Torvalds wrote:
> On Tue, Jan 19, 2016 at 2:30 AM, Ingo Molnar <mingo@...nel.org> wrote:
>>
>>
>> So it should be something like:
>>
>>          config GENERIC_BOOTABLE_CONFIG
>>          bool "Enable kernel options that are needed to boot typical Linux distributions"
>>          default y
>>          ...
>>
>> (I removed the 'SANE' naming as disabling this option is obviously not 'insane'.)
>
> I think we should just make it distro-specific rather than claiming it
> is generic (and inevitably failing).
>
> So we could have a config option for SYSTEMD, which selects stuff
> systemd wants, and then distros that use systemd can select that etc.
>
> It shouldn't be about just bootability either. Some of the networking
> options end up being security-critical (ie your firewall might not
> work if you don't have the right options enabled, leaving you wide
> open after you boot).
It might be worth looking at Gentoo's kernel patches, they've had one 
for a while now (I think roughly a year and a half) that does pretty 
much this, you get options for each of their officially supported init 
systems (OpenRC, and SystemD, although the systemd option is not 
anywhere near as complete as what was proposed here), one for portage 
(which needs some specific namespace stuff for sandboxing builds), and I 
think one for udev.  Theirs however uses depends instead of selects, but 
I think that fits a bit better (If I tell the config to make sure I can 
boot using a particular init system, I expect it to not let me change 
things that would prevent me from booting using that init system).