linux-kernel - Re: [RFC PATCH] x86/Kconfig: Disable KASLR on debug builds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231201162443.GBZWoIywsIqB+SNh9n@fat_crate.local>
Date:   Fri, 1 Dec 2023 17:24:43 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Nathan Chancellor <nathan@...nel.org>
Cc:     X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH] x86/Kconfig: Disable KASLR on debug builds

On Fri, Dec 01, 2023 at 09:16:10AM -0700, Nathan Chancellor wrote:
> Right, this is the diff of Fedora's configuration before and after this
> change:

Sorry, but what's the point of a .config which has EXPERT, DEBUG_KERNEL
*and* KASLR enabled?

Debugging the kernel with KASLR enabled is a futile exercise in time
waste. You should either enable KASLR and disable DEBUG_KERNEL or the
opposite. Both make very little sense to me.

Or, if there really is a valid reason for having DEBUG_KERNEL *and*
KASLR enabled, I can probably suggest another option under DEBUG_KERNEL
which says "Do stable virtual addresses" and which disables KASLR. At
least we'll have it explicit.

And the distro configs do get re-checked periodically so "it is already
in the distro config" is not really an argument I'd say.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette