Re: [PATCH v3 10/10] x86-64: Add CONFIG_UNSAFE_VSYSCALLS tofeature-removal-schedule

[Ingo Molnar]

* Valdis.Kletnieks@xxxxxx <Valdis.Kletnieks@xxxxxx> wrote:

> On Wed, 01 Jun 2011 13:41:56 EDT, Andrew Lutomirski said:
> 
> >> +         On a system with recent enough glibc (probably 2.14 or
> >>  +         newer) and no static binaries, you can say N without a
> >>  +         performance penalty to improve security
> >>
> >> So I checked my laptop (Fedora 16 Rawhide), and found a bunch of static binaries. The ones
> >> that look like people may care:
> 
> > The binaries will still work -- they'll just take a small performance
> > hit (~220ns on Sandy Bridge) every time they call time().
> 
> Ah. I misparsed the Kconfig help - I read it as "If you have no 
> static binaries, setting this to N doesn't introduce a performance 
> hit" (with an implied "if you have static binaries, this will hose 
> you").  Adding "Static binaries will continue to work at a very 
> small performance penalty" would probably help.

Yeah, would be nice to add that clarification. (or better yet, 
reformulate it in a way that makes it really obvious from the get 
go.)

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/