[kernel-hardening] Re: [RFC] ipc: introduce shm_rmid_forced sysctl

[Ingo Molnar <mingo@elte.hu>]

* Andrew Morton <akpm@linux-foundation.org> wrote:

> > --- a/ipc/shm.c
> > +++ b/ipc/shm.c
> > @@ -74,6 +74,7 @@ void shm_init_ns(struct ipc_namespace *ns)
> >  	ns->shm_ctlmax = SHMMAX;
> >  	ns->shm_ctlall = SHMALL;
> >  	ns->shm_ctlmni = SHMMNI;
> > +	ns->shm_rmid_forced = 0;
> >  	ns->shm_tot = 0;
> >  	ipc_init_ids(&shm_ids(ns));
> >  }
> 
> The problem is that nobody will test your feature.  So for testing
> purposes, let's enable the feature by default.  I assume this:

I'd also strongly argue to keep this as a default. OOM-kills are not 
part of POSIX and violate POSIX in a number of ways already.

Furthermore, if testing shows that this is not actually breaking 
anything in a serious way we could also in theory simplify the patch 
and just make this the default behavior with no runtime ability to 
switch it off.

Thanks,

	Ingo