Re: [PATCH] VFS: add config options to enable link restrictions

[Linus Torvalds]

On Fri, Oct 26, 2012 at 12:46 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> I think there's value in being able to enable these protections at
> build-time so there's no need for a distro to have to ship extra
> files/lines, spend time setting it, etc.

The "value in not having to change the distro" is valid value. That
said, two lines to rc.local does that too.

But dammit, every single discussion I see, you use some *other*
argument for it, like "people don't have initrd" or whatever crazy
crap. That's what I was objecting to.

> Would a single config item be acceptable? What would be an agreeable
> way to enable this at build-time?

I dunno. Maybe a CONFIG_LOCKDOWN thing that sets a few of our other
default values as well. Or at least hide the config options from
normal users behind some extra security menu, so that people just
don't have to care this deeply. Because most people *don't* care.

I also don't see why it would be a build-time config option at all.
Why not just expose them as option using module_param_named(), and
then you can do it in the kernel command flags (and set it in your
grub.conf etc).

            Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/