linux-kernel - Re: [less-CONFIG_NET v2 7/8] seccomp: drop CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGXu5jJBvkxpnZS31hJuUo-5vTes=mLeoM=28HXD+UfzKYsv-w@mail.gmail.com>
Date:   Thu, 28 Jun 2018 12:02:55 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Norbert Manthey <nmanthey@...zon.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Nicholas Piggin <npiggin@...il.com>,
        Arnd Bergmann <arnd@...db.de>, Josef Bacik <jbacik@...com>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Deepa Dinamani <deepa.kernel@...il.com>
Subject: Re: [less-CONFIG_NET v2 7/8] seccomp: drop CONFIG_NET

On Thu, Jun 28, 2018 at 5:45 AM, Norbert Manthey <nmanthey@...zon.de> wrote:
> With the goal of dropping CONFIG_NET, we have to drop the dependency
> in the configuration management. Since SECCOMP_FILTER also requires
> BPF functionality, which is usually activated by CONFIG_NET, imply
> BPF from SECCOMP_FILTER directly.

Nit: "select" not "imply"

> In case both CONFIG_NET and CONFIG_SECCOMP_FILTER are activated, BPF
> will be activated as well, so this additional dependency does not
> destroy original builds.
>
> Signed-off-by: Norbert Manthey <nmanthey@...zon.de>

Otherwise, sure. As long as this still compiles and runs, it looks
fine to me! :)

-Kees

> ---
>  arch/Kconfig | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 1aa5906..8cfb634 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -397,7 +397,8 @@ config HAVE_ARCH_SECCOMP_FILTER
>
>  config SECCOMP_FILTER
>         def_bool y
> -       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
> +       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP
> +       select BPF
>         help
>           Enable tasks to build secure computing environments defined
>           in terms of Berkeley Packet Filter programs which implement
> --
> 2.7.4
>
> Amazon Development Center Germany GmbH
> Berlin - Dresden - Aachen
> main office: Krausenstr. 38, 10117 Berlin
> Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
> Ust-ID: DE289237879
> Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
>



-- 
Kees Cook
Pixel Security