From: "H. Peter Anvin" <hpa@zytor.com>
To: Rusty Russell <rusty@rustcorp.com.au>
Cc: Andi Kleen <andi@firstfloor.org>,
Siarhei Liakh <sliakh.lkml@gmail.com>,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-next@vger.kernel.org,
Arjan van de Ven <arjan@infradead.org>,
James Morris <jmorris@namei.org>,
Andrew Morton <akpm@linux-foundation.org>, Andi Kleen <ak@muc.de>,
Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@elte.hu>,
Stephen Rothwell <sfr@canb.auug.org.au>,
Dave Jones <davej@redhat.com>
Subject: Re: [PATCH v8] RO/NX protection for loadable kernel modules
Date: Sun, 07 Feb 2010 17:54:03 -0800 [thread overview]
Message-ID: <4B6F6EBB.5070106@zytor.com> (raw)
In-Reply-To: <201002081215.31527.rusty@rustcorp.com.au>
On 02/07/2010 05:45 PM, Rusty Russell wrote:
>
> Strict RO/NX protection. But without the option enabled, the patch gives
> best-effort protection, which is nice (for no additional space).
>
Since Linux kernel modules are actually .o's, not .so's, in theory we
could bundle the sections together by type. There could still be
external fragmentation, of course, but on most systems module unload is
relatively rare.
-hpa
--
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel. I don't speak on their behalf.
prev parent reply other threads:[~2010-02-08 1:58 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-31 23:22 [PATCH v8] RO/NX protection for loadable kernel modules Siarhei Liakh
2010-02-01 1:39 ` Rusty Russell
2010-02-01 16:22 ` Siarhei Liakh
2010-02-02 23:05 ` Andi Kleen
2010-02-03 4:07 ` Siarhei Liakh
2010-02-08 1:45 ` Rusty Russell
2010-02-08 1:54 ` H. Peter Anvin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B6F6EBB.5070106@zytor.com \
--to=hpa@zytor.com \
--cc=ak@muc.de \
--cc=akpm@linux-foundation.org \
--cc=andi@firstfloor.org \
--cc=arjan@infradead.org \
--cc=davej@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=rusty@rustcorp.com.au \
--cc=sfr@canb.auug.org.au \
--cc=sliakh.lkml@gmail.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).