lkml.org 
[lkml]   [2017]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [GIT PULL] usercopy whitelisting for v4.15-rc1
On Fri, Nov 17, 2017 at 1:13 PM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
> As long as you see your hardening efforts primarily as a "let me kill
> the machine/process on bad behavior", I will stop taking those shit
> patches.

Yes, this is entirely clear. This is why I adjusted this series (in
multiple places) to use WARN, etc etc. And why I went to great lengths
to document the rationale, effects, and alloc/use paths so when
something went wrong it would be easy to see what was happening and
why.

> So the hardening efforts should instead _start_ from the standpoint of
> "let's warn about what looks dangerous, and maybe in a _year_ when
> we've warned for a long time, and we are confident that we've actually
> caught all the normal cases, _then_ we can start taking more drastic
> measures".

Understood: I think my main flaw in helping bring these defenses to
the kernel has been thinking they can be fully tested during a single
development cycle, and this mistake was made quite clear this cycle,
which is why I adjusted the series like I did.

> Right now, the biggest problem for me is that the whole thing makes me
> uncomfortable, because I think the people involved are coming from a
> completely unacceptable model to begin with.
>
> And we had this exact issue with the _previous_ user mode access
> hardening. People apparently didn't learn a goddamn thing.

Well, I'd like to think I did learn something, since I fixed up this
series _before_ you yelled at me. :)

I'll make further adjustments and try again for v4.16.

-Kees

--
Kees Cook
Pixel Security

\
 
 \ /
  Last update: 2017-11-17 23:21    [W:0.425 / U:0.008 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site