On Thursday, 19 May 2022 04:15:16 BST Hellosway Here via devel wrote: > Add `slab_nomerge init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on > randomize_kstack_offset=on vsyscall=none ` as default kernel command line > arguments. This can help prevent local exploits by making it harder to > exploit the kernel. I do not think there will be any breakage, I have been > using these for a long time. The performance impact is minimal, a few of > these can improve performance. A question, then: if these options are helpful to performance and/or security, why are they not yet the kernel's defaults? If there are tradeoffs that mean that these aren't suitable for general use, then Fedora needs to know what those tradeoffs are before it can make the decision, while if they're a simple net improvement, then upstream kernel developers should be happy to switch the defaults over without requiring a kernel argument. > This can help increase the security of Fedora, while also not causing any > other problems. Many users do not know what kernel command line arguments > are, so doing this will help them with the security of their system. This > does not address every problem, or even most of them, but every little bit > matters. If that's the case, why doesn't the upstream kernel switch them over? Is there an ABI break caused by some of these? A major performance regression on some workloads (if so, which workloads and does Fedora care)? Known bugs that upstream hasn't tracked down yet? -- Simon Farnsworth _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
