On Fri, Oct 26, 2012 at 1:12 PM, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Fri, Oct 26, 2012 at 12:46 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: >> Would a single config item be acceptable? What would be an agreeable >> way to enable this at build-time? > > I dunno. Maybe a CONFIG_LOCKDOWN thing that sets a few of our other > default values as well. Or at least hide the config options from > normal users behind some extra security menu, so that people just > don't have to care this deeply. Because most people *don't* care. My take is that while most people don't care, they also should have it enabled. It really is only corner-cases that run into problems. All the other situations are actual security vulnerabilities. So I'd really like to make this as easy as possible to be "on by default" for some extremely early definition of "by default". > I also don't see why it would be a build-time config option at all. > Why not just expose them as option using module_param_named(), and > then you can do it in the kernel command flags (and set it in your > grub.conf etc). I'd like it to be the exception to turn it _off_, rather than the exception to turn it on. I'm happy to start collecting things under CONFIG_LOCKDOWN, but I worry it'd just turn into the opposite of CONFIG_EXPERIMENTAL where if there was some value in it that someone didn't want on, they'd leave it off, etc. Most distros have infrastructure for maintaining their desired configs, so I didn't think the granularity was very bad as I sent it. Every distro will ship with this enabled (except perhaps Damn Vulnerable Linux), so why make it harder? -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
