Re: [PATCH] VFS: add config options to enable link restrictions

[Kees Cook]

On Fri, Oct 26, 2012 at 1:12 PM, Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> On Fri, Oct 26, 2012 at 12:46 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>> Would a single config item be acceptable? What would be an agreeable
>> way to enable this at build-time?
>
> I dunno. Maybe a CONFIG_LOCKDOWN thing that sets a few of our other
> default values as well. Or at least hide the config options from
> normal users behind some extra security menu, so that people just
> don't have to care this deeply. Because most people *don't* care.

My take is that while most people don't care, they also should have it
enabled. It really is only corner-cases that run into problems. All
the other situations are actual security vulnerabilities. So I'd
really like to make this as easy as possible to be "on by default" for
some extremely early definition of "by default".

> I also don't see why it would be a build-time config option at all.
> Why not just expose them as option using module_param_named(), and
> then you can do it in the kernel command flags (and set it in your
> grub.conf etc).

I'd like it to be the exception to turn it _off_, rather than the
exception to turn it on.

I'm happy to start collecting things under CONFIG_LOCKDOWN, but I
worry it'd just turn into the opposite of CONFIG_EXPERIMENTAL where if
there was some value in it that someone didn't want on, they'd leave
it off, etc. Most distros have infrastructure for maintaining their
desired configs, so I didn't think the granularity was very bad as I
sent it.

Every distro will ship with this enabled (except perhaps Damn
Vulnerable Linux), so why make it harder?

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/