Re: [RFC][PATCH] x86/mm: warn on W+x mappings

[Borislav Petkov <bp@alien8.de>]

On Fri, Oct 02, 2015 at 09:26:44AM +0200, Ingo Molnar wrote:
> It's better to generate a WARN()ing programmatically if the W+X condition occurs, 
> that gets noticed by tools and people alike. I'd like to start treating that 
> condition as a hard kernel bug.
> 
> A dump in dmesg is subject to random noise by printk crusaders and is also subject 
> to general bitrot, nor does it provide any ready warning to act upon.

You're not going to enable this option in production anyway. So when it
is enabled, you're expected to stare at dmesg anyway. The only advantage
of the WARN()'s is that they're bigger. :)

> Adding an extra debug option is a good idea (just please don't put 'EFI' into the 
> name - this isn't really EFI related), to not generate the debugfs node.

Of course not - it was just an example how the EFI code uses PTDUMP. There it is
off by default too.

> I'd even add this debug check as default-enabled in the x86 defconfigs, so that my 
> own continuous kernel testing kit picks up any new warnings from it.

There's the problem with exposing sensitive info in debugfs if you do
that. And nowadays we're trying hard not to leak any of that.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.