linux-kernel - Re: [PATCH v1] init: Do not select DEBUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5j+Qz4RTeXR8UYqoYnQtLf42QLn5duUue_OmdKQKq7MeZw@mail.gmail.com>
Date:   Wed, 10 Apr 2019 15:28:09 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Sinan Kaya <Okaya@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Johannes Weiner <hannes@...xchg.org>,
        "Peter Zijlstra (Intel)" <peterz@...radead.org>,
        Nicholas Piggin <npiggin@...il.com>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Adrian Reber <adrian@...as.de>,
        Richard Guy Briggs <rgb@...hat.com>
Subject: Re: [PATCH v1] init: Do not select DEBUG_KERNEL by default

On Wed, Apr 10, 2019 at 3:25 PM Sinan Kaya <Okaya@...nel.org> wrote:
>
> On 4/10/2019 6:21 PM, Kees Cook wrote:
> >> I can go after individual enables if you agree assuming Mathieu will
> >> go after the changes in the other email. Let me know otherwise.
> > How about you split it, but make DEBUG_KERNEL be "default EXPERT" that
> > way enabling EXPERT will enable DEBUG_KERNEL still in the default
> > case?
>
> Sorry, can you explain what you mean by split?

I mean when you disconnect them (i.e. remove the "select" in EXPERT)

> Do you mean move the things I need out of EXPERT? or something else?

So, for example, this:

diff --git a/init/Kconfig b/init/Kconfig
index c9386a365eea..7ce4a60ab3e9 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1188,8 +1188,6 @@ config BPF

 menuconfig EXPERT
        bool "Configure standard kernel features (expert users)"
-       # Unhide debug options, to make the on-by-default options visible
-       select DEBUG_KERNEL
        help
          This option allows certain base kernel options and settings
           to be disabled or tweaked. This is for specialized
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index d4df5b24d75e..6a9bc118b64a 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -433,6 +433,7 @@ config MAGIC_SYSRQ_SERIAL

 config DEBUG_KERNEL
        bool "Kernel debugging"
+       default EXPERT
        help
          Say Y here if you are developing drivers or trying to debug and
          identify kernel problems.

Then you shouldn't need the KALLSYMS_ALL change, yes? But maybe I
misunderstood that.

-- 
Kees Cook