public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 0/4] Allow default HARDENED_USERCOPY to be set at compile time
@ 2025-01-23 22:11 Mel Gorman
  2025-01-23 22:11 ` [PATCH 1/4] mm: security: Move hardened usercopy under 'Kernel hardening options' Mel Gorman
                   ` (5 more replies)
  0 siblings, 6 replies; 11+ messages in thread
From: Mel Gorman @ 2025-01-23 22:11 UTC (permalink / raw)
  To: Kees Cook
  Cc: Daniel Micay, Paul Moore, linux-hardening, linux-kernel,
	Mel Gorman

Changelog since v2
o Default on
o Logic correction and simplification

Changelog since v1
o Menu section rename
o Make static branch usage similar to init_on_alloc
o Change ordering of menu options

Some hardening options like HARDENED_USERCOPY can be set at boot time
and have negligible cost when disabled. The default for options like
init_on_alloc= can be set at compile time but hardened usercopy is
enabled by default if built in. This incurs overhead when a kernel
wishes to provide optional hardening but the user does not necessarily
care.

Hardening is desirable in some environments but ideally they would be opt-in
by kernel command line as hardening is typically a deliberate decision
whereas the performance overhead is not always obvious to all users.
Patches 1 and 2 move HARDENED_USERCOPY to the Kconfig.hardening and
default it to disabled. Patch 3 moves the static branch check to a fast
path similar to init_on_*. Patch 4 moves FORTIFY_SOURCE to hardening only
because the option is related to hardening and happened to be declared
near HARDENED_USERCOPY.

Building HARDENED_USERCOPY but disabled at runtime has neligible effect
within the noise. Enabling the option by default generally incurs 2-10%
of overhead depending on the workload with some extreme outliers depending
on the exact CPU. While the benchmarks are somewhat synthetic, the overhead
IO-intensive and network-intensive is easily detectable but the root cause
may not be obvious (e.g. 2-14% overhead for netperf TCP_STREAM running
over localhost with different ranges depending on the CPU).

 .../admin-guide/kernel-parameters.txt         |  4 ++-
 include/linux/thread_info.h                   |  8 ++++-
 mm/usercopy.c                                 | 16 +++++----
 security/Kconfig                              | 21 ------------
 security/Kconfig.hardening                    | 33 +++++++++++++++++++
 5 files changed, 52 insertions(+), 30 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 11+ messages in thread
* [PATCH v2 0/4] Allow default HARDENED_USERCOPY to be set at compile time
@ 2025-01-22 17:19 Mel Gorman
  2025-01-22 17:19 ` [PATCH 2/4] mm: security: " Mel Gorman
  0 siblings, 1 reply; 11+ messages in thread
From: Mel Gorman @ 2025-01-22 17:19 UTC (permalink / raw)
  To: Kees Cook
  Cc: Daniel Micay, Paul Moore, linux-hardening, linux-kernel,
	Mel Gorman

Changelog since v1
o Menu section rename
o Make static branch usage similar to init_on_alloc
o Change ordering of menu options

Some hardening options like HARDENED_USERCOPY can be set at boot time
and have negligible cost when disabled. The default for options like
init_on_alloc= can be set at compile time but hardened usercopy is
enabled by default if built in. This incurs overhead when a kernel
wishes to provide optional hardening but the user does not necessarily
care.

Hardening is desirable in some environments but ideally they would be opt-in
by kernel command line as hardening is typically a deliberate decision
whereas the performance overhead is not always obvious to all users.
Patches 1 and 2 move HARDENED_USERCOPY to the Kconfig.hardening and
default it to disabled. Patch 3 moves the static branch check to a fast
path similar to init_on_*. Patch 4 moves FORTIFY_SOURCE to hardening only
because the option is related to hardening and happened to be declared
near HARDENED_USERCOPY.

Building HARDENED_USERCOPY but disabled at runtime has neligible effect
within the noise. Enabling the option by default generally incurs 2-10%
of overhead depending on the workload with some extreme outliers depending
on the exact CPU. While the benchmarks are somewhat synthetic, the overhead
IO-intensive and network-intensive is easily detectable but the root cause
may not be obvious (e.g. 2-14% overhead for netperf TCP_STREAM running
over localhost with different ranges depending on the CPU).

 .../admin-guide/kernel-parameters.txt         |  4 ++-
 include/linux/thread_info.h                   |  8 +++++
 mm/usercopy.c                                 | 14 ++++----
 security/Kconfig                              | 21 ------------
 security/Kconfig.hardening                    | 33 +++++++++++++++++++
 5 files changed, 52 insertions(+), 28 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2025-02-11  0:46 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-23 22:11 [PATCH v3 0/4] Allow default HARDENED_USERCOPY to be set at compile time Mel Gorman
2025-01-23 22:11 ` [PATCH 1/4] mm: security: Move hardened usercopy under 'Kernel hardening options' Mel Gorman
2025-01-23 22:11 ` [PATCH 2/4] mm: security: Allow default HARDENED_USERCOPY to be set at compile time Mel Gorman
2025-01-23 22:11 ` [PATCH 3/4] mm: security: Check early if HARDENED_USERCOPY is enabled Mel Gorman
2025-01-23 22:11 ` [PATCH 4/4] fortify: Move FORTIFY_SOURCE under 'Kernel hardening options' Mel Gorman
2025-01-23 23:51 ` [PATCH v3 0/4] Allow default HARDENED_USERCOPY to be set at compile time Kees Cook
2025-02-11  0:45 ` Kees Cook
  -- strict thread matches above, loose matches on Subject: below --
2025-01-22 17:19 [PATCH v2 " Mel Gorman
2025-01-22 17:19 ` [PATCH 2/4] mm: security: " Mel Gorman
2025-01-23  0:57   ` Kees Cook
2025-01-23 11:37     ` Mel Gorman
2025-01-23 21:10     ` David Laight

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox