Messages in this thread | | | Date | Sun, 16 Nov 2008 01:09:14 +0100 | From | Bernhard Walle <> | Subject | Re: [PATCH 2/2] Add dev.mem.restricted sysctl |
| |
* Alan Cox [2008-11-16 00:07]: > > On Sun, 16 Nov 2008 01:03:43 +0100 > Bernhard Walle <bwalle@suse.de> wrote: > > > When CONFIG_STRICT_DEVMEM is set, live debugging is not possible with the > > crash utility (see http://people.redhat.com/~anderson). For distributors > > who ship a generic kernel it's difficult: Disabling CONFIG_STRICT_DEVMEM > > is possible, but in general the protection provided by CONFIG_STRICT_DEVMEM > > is useful. However, live debugging should be still neceessary. > > Why not just turn strictmem off - as you've correctly demonstrated its > completely useless and always was. > > A switchable configurable piece of turd is still at the end of the day a > piece of turd.
Well, I think that option makes sense to protect the system from processes that *accidentally* read/write to the wrong memory location (like the X server that always runs as root).
Regards, Bernhard
| |