linux-kernel - [PATCH] x86/mm/pkeys: Do not enable them by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 19 Feb 2016 12:27:15 +0100
From:	Borislav Petkov <bp@...en8.de>
To:	Dave Hansen <dave.hansen@...ux.intel.com>
Cc:	linux-tip-commits@...r.kernel.org, linux-kernel@...r.kernel.org,
	brgerst@...il.com, tglx@...utronix.de,
	torvalds@...ux-foundation.org, hpa@...or.com,
	dave.hansen@...ux.intel.com, akpm@...ux-foundation.org,
	peterz@...radead.org, mingo@...nel.org, luto@...capital.net,
	dvlasenk@...hat.com, dave@...1.net, riel@...hat.com
Subject: [PATCH] x86/mm/pkeys: Do not enable them by default

On Thu, Feb 18, 2016 at 12:16:47PM -0800, tip-bot for Dave Hansen wrote:
> Commit-ID:  35e97790f5f1e5cf2b5522c55e3e31d5c81bd226
> Gitweb:     http://git.kernel.org/tip/35e97790f5f1e5cf2b5522c55e3e31d5c81bd226
> Author:     Dave Hansen <dave.hansen@...ux.intel.com>
> AuthorDate: Fri, 12 Feb 2016 13:02:00 -0800
> Committer:  Ingo Molnar <mingo@...nel.org>
> CommitDate: Tue, 16 Feb 2016 10:11:13 +0100
> 
> x86/mm/pkeys: Add Kconfig option
> 
> I don't have a strong opinion on whether we need a Kconfig prompt
> or not.  Protection Keys has relatively little code associated
> with it, and it is not a heavyweight feature to keep enabled.
> However, I can imagine that folks would still appreciate being
> able to disable it.
> 
> Note that, with disabled-features.h, the checks in the code
> for protection keys are always the same:
> 
> 	cpu_has(c, X86_FEATURE_PKU)
> 
> With the config option disabled, this essentially turns into an

whoops, something is missing here. An "#ifdef."

...

>  arch/x86/Kconfig | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index ab2ed53..3632cdd 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -1714,6 +1714,10 @@ config X86_INTEL_MPX
>  
>  	  If unsure, say N.
>  
> +config X86_INTEL_MEMORY_PROTECTION_KEYS
> +	def_bool y

This is not necessary.

---
From: Borislav Petkov <bp@...e.de>
Date: Fri, 19 Feb 2016 12:19:50 +0100
Subject: [PATCH] x86/mm/pkeys: Do not enable them by default

No need to default to y.

Signed-off-by: Borislav Petkov <bp@...e.de>
---
 arch/x86/Kconfig | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index d10826d2cb5e..109bc46ccb60 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1719,8 +1719,7 @@ config X86_INTEL_MPX
 	  If unsure, say N.
 
 config X86_INTEL_MEMORY_PROTECTION_KEYS
-	prompt "Intel Memory Protection Keys"
-	def_bool y
+	bool "Intel Memory Protection Keys"
 	# Note: only available in 64-bit mode
 	depends on CPU_SUP_INTEL && X86_64
 	---help---
-- 
2.3.5

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.