lkml.org 
[lkml]   [2009]   [Oct]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v2] [x86] detect and report lack of NX protections
    Hi,

    On Tue, Oct 20, 2009 at 11:18:43AM +0900, H. Peter Anvin wrote:
    > On 10/20/2009 11:04 AM, Kees Cook wrote:
    > >It is possible for x86_64 systems to lack the NX bit (see check_efer())
    > >either due to the hardware lacking support or the BIOS having turned
    > >off the CPU capability, so NX status should be reported. Additionally,
    > >anyone booting NX-capable CPUs in 32bit mode without PAE will lack NX
    > >functionality, so this change provides feedback for that case as well.
    > >
    > >v2: use "Alert:" instead of "Warning:" to avoid confusiong with WARN_ON()
    > >
    >
    > They're both wrong. Both imply that the user needs to take an
    > action, which is wrong because the kernel is working as intended.
    > If you need to use any kind of alert word, it should be something
    > like "Notice:", and it should be KERN_NOTICE or even KERN_INFO.

    In the case of a system where the BIOS was shipped with XD not enabled,
    the user needs to take an action. I'm okay with switching to Notice:, but
    I don't think KERN_INFO is right. I would agree, "Alert:" would seem to
    be a KERN_ALERT, which is above KERN_CRIT, which this is clearly not.
    "Notice" it is.

    -Kees

    --
    Kees Cook
    Ubuntu Security Team


    \
     
     \ /
      Last update: 2009-10-20 06:49    [W:3.227 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site