On Mon, Feb 26, 2024 at 02:37:29PM -0800, Doug Anderson wrote: > Hi, > > On Mon, Feb 26, 2024 at 2:33 PM Adrian Ratiu <adrian.ratiu@xxxxxxxxxxxxx> wrote: > > > > > > [...] > > > > +config SECURITY_PROC_MEM_RESTRICT_WRITES > > > > > > Instead of a build-time CONFIG, I'd prefer a boot-time config (or a > > > sysctl, but that's be harder given the perms). That this is selectable > > > by distro users, etc, and they don't need to rebuild their kernel to > > > benefit from it. > > > > Ack, I'll implement a cmdline arg in v2. > > Any objections to doing both? Have a CONFIG option for a default and a > cmdline to override it? This way if a distro wants to restrict writes > by default then don't need to jam more stuff into the kernel command > line. For an example, take a look at randomize_kstack_offset and CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT. -- Kees Cook
