linux-kernel - Re: [PATCH] tty: sysrq: Introduce compile-time crash-only mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025070804-curler-hummus-8766@gregkh>
Date: Tue, 8 Jul 2025 10:05:24 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Marwan Seliem <marwanmhks@...il.com>
Cc: akpm@...ux-foundation.org, jirislaby@...nel.org,
	linux-kernel@...r.kernel.org, linux-serial@...r.kernel.org
Subject: Re: [PATCH] tty: sysrq: Introduce compile-time crash-only mode

On Tue, Jul 08, 2025 at 12:16:50AM +0300, Marwan Seliem wrote:
> Let me clarify the security rationale and address your concerns.
> 
> > "security" involves crashing the system, so I fail to understand why one
> > is more "secure" than the other.
> 
> You're absolutely right that crash access itself requires careful consideration. 
> The security distinction we're making is between:
> 
> 1. Controlled Crash Access (our patch):
>    - Single, auditable code path (only sysrq-c)
>    - No runtime configuration possible
>    - No ancillary debug features that could leak information
> 
> 2. Full SysRq Access:
>    - ~60 command vectors to maintain/audit
>    - Runtime configuration complexity
>    - Features like memory/register dumps

One can make this argument for each of the sysrq options, but attempting
to make each one a config option is crazy.  We have chosen the "either
all or none" to make things simpler overall.

So attempting to maintain yet-another-configuration-option like this,
for the next 40+ years, is adding to our maintance burden for almost no
benifit that I can determine (hint, I still think it's crazy to allow a
system to crash but not the other things.)

So I can't accept this added complexity at this point in time, sorry.
If you can convince others that this really is worth the overhead
involved in it, please do so and come back with some more support.

thanks,

greg k-h