From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751443AbbJBIMy (ORCPT ); Fri, 2 Oct 2015 04:12:54 -0400 Received: from mail.skyhub.de ([78.46.96.112]:41145 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750925AbbJBIMp (ORCPT ); Fri, 2 Oct 2015 04:12:45 -0400 Date: Fri, 2 Oct 2015 10:02:40 +0200 From: Borislav Petkov To: Ingo Molnar Cc: Kees Cook , Stephen Smalley , "x86@kernel.org" , LKML Subject: Re: [RFC][PATCH] x86/mm: warn on W+x mappings Message-ID: <20151002080239.GC16538@pd.tnic> References: <1443716923-6072-1-git-send-email-sds@tycho.nsa.gov> <20151001194121.GC3764@pd.tnic> <20151002072643.GA5035@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20151002072643.GA5035@gmail.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Oct 02, 2015 at 09:26:44AM +0200, Ingo Molnar wrote: > It's better to generate a WARN()ing programmatically if the W+X condition occurs, > that gets noticed by tools and people alike. I'd like to start treating that > condition as a hard kernel bug. > > A dump in dmesg is subject to random noise by printk crusaders and is also subject > to general bitrot, nor does it provide any ready warning to act upon. You're not going to enable this option in production anyway. So when it is enabled, you're expected to stare at dmesg anyway. The only advantage of the WARN()'s is that they're bigger. :) > Adding an extra debug option is a good idea (just please don't put 'EFI' into the > name - this isn't really EFI related), to not generate the debugfs node. Of course not - it was just an example how the EFI code uses PTDUMP. There it is off by default too. > I'd even add this debug check as default-enabled in the x86 defconfigs, so that my > own continuous kernel testing kit picks up any new warnings from it. There's the problem with exposing sensitive info in debugfs if you do that. And nowadays we're trying hard not to leak any of that. -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply.