linux-kernel - Re: [PATCH] gcc-plugins: disable under COMPILE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1465869698.18900.2.camel@ellerman.id.au>
Date:	Tue, 14 Jun 2016 12:01:38 +1000
From:	Michael Ellerman <mpe@...erman.id.au>
To:	Kees Cook <keescook@...omium.org>,
	"Austin S. Hemmelgarn" <ahferroin7@...il.com>
Cc:	Emese Revfy <re.emese@...il.com>,
	Paul Gortmaker <paul.gortmaker@...driver.com>,
	Michal Marek <mmarek@...e.com>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	Sudip Mukherjee <sudipm.mukherjee@...il.com>,
	Linux-Next <linux-next@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	"kernel-hardening@...ts.openwall.com" 
	<kernel-hardening@...ts.openwall.com>
Subject: Re: [PATCH] gcc-plugins: disable under COMPILE_TEST

On Mon, 2016-06-13 at 13:11 -0700, Kees Cook wrote:
> On Mon, Jun 13, 2016 at 11:32 AM, Austin S. Hemmelgarn
> <ahferroin7@...il.com> wrote:
> > On 2016-06-12 20:18, Emese Revfy wrote:
> > > 
> > > On Sun, 12 Jun 2016 15:25:39 -0700
> > > Kees Cook <keescook@...omium.org> wrote:
> > > 
> > > > I don't like this because it means if someone specifically selects
> > > > some plugins in their .config, and the headers are missing, the kernel
> > > > will successfully compile. For many plugins, this results in a kernel
> > > > that lacks the requested security features, and that I really do not
> > > > want to have happening. I'm okay leaving these disabled for compile
> > > > tests for now. We can revisit this once more distros have plugins
> > > > enabled by default.
> > > 
> > > You are right. Your patch is safer.
> > > 
> > Why not make it so that if COMPILE_TEST is enabled, the build warns if it
> > can't find the headers, otherwise it fails?  That way, people who are doing
> > all*config builds but don't have the headers will still get some build
> > coverage, and the people who are enabling it as a security feature will
> > still get build failures.
> 
> I don't see a clear way to do this, but if you can find a way to make
> that happen, please send a patch! :)

Another option is to make the top-level option negative, that way when it's
enabled by allmod/yes the plugins are turned off.

So eg. you would have:

config DISABLE_GCC_PLUGINS
	bool "Disable building GCC plugins"
	default y
	...
	
This makes all the problems with allmod/yes go away, and means you always honor
the users intent - when DISABLE_GCC_PLUGINS=n you can fail the build if you
can't build the plugins.

The downside is the logic's a bit awkward, ie. to enable the plugins you have to
disable the option which disables them.

cheers