On Fri, Jun 23, 2017 at 7:06 AM, Michal Hocko <mhocko@xxxxxxxxxx> wrote: > On Tue 20-06-17 16:09:11, Kees Cook wrote: >> Some hardened environments want to build kernels with slab_nomerge >> already set (so that they do not depend on remembering to set the kernel >> command line option). This is desired to reduce the risk of kernel heap >> overflows being able to overwrite objects from merged caches and changes >> the requirements for cache layout control, increasing the difficulty of >> these attacks. By keeping caches unmerged, these kinds of exploits can >> usually only damage objects in the same cache (though the risk to metadata >> exploitation is unchanged). > > Do we really want to have a dedicated config for each hardening specific > kernel command line? I believe we have quite a lot of config options > already. Can we rather have a CONFIG_HARDENED_CMD_OPIONS and cover all > those defauls there instead? There's not been a lot of success with grouped Kconfigs in the past (e.g. CONFIG_EXPERIMENTAL), but one thing that has been suggested is a defconfig-like make target that would collect all the things together. I haven't had time for that, but that would let us group the various configs. Additionally, using something like CONFIG_CMDLINE seems a little clunky to me. -Kees -- Kees Cook Pixel Security -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
