From: Siddhesh Poyarekar <siddhesh@gotplt.org>
To: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>,
DJ Delorie <dj@redhat.com>
Cc: libc-alpha@sourceware.org
Subject: Re: RFC: system-wide default tunables
Date: Tue, 17 Oct 2023 10:17:11 -0400 [thread overview]
Message-ID: <8b216d3c-5f38-3ef5-1764-8cd811936714@gotplt.org> (raw)
In-Reply-To: <cf589d17-c71b-48bd-a500-67a6b445a082@linaro.org>
On 2023-10-17 10:10, Adhemerval Zanella Netto wrote:
> But we already have opt-in security features with glibc.cpu.x86_ibt,
> glibc.cpu.x86_shstk, and glibc.mem.tagging. At least the x86 ones,
> the default is set by an ELF property (assuming --enable-cet), but
> memory tagging is complete opt-in.
>
> That's why I think we either need to add some security context on
> system-wide tunables; where the tunable can not be override by user;
> or move the opt-in security tunable to a different mechanism.
Only stricter overrides to systemwide tunables should be allowed, e.g.
going from enabled memory tagging to disabled memory tagging. For
numeric values such as mmap_threshold, we may need to figure out on a
case by case basis what constitutes "stricter".
Thanks,
Sid
next prev parent reply other threads:[~2023-10-17 14:17 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-04 20:55 DJ Delorie
2023-10-06 14:44 ` Adhemerval Zanella Netto
2023-10-06 17:12 ` Adhemerval Zanella Netto
2023-10-06 18:29 ` DJ Delorie
2023-10-06 19:14 ` Adhemerval Zanella Netto
2023-10-06 20:25 ` DJ Delorie
2023-10-17 14:10 ` Adhemerval Zanella Netto
2023-10-17 14:17 ` Siddhesh Poyarekar [this message]
2023-10-17 14:37 ` Siddhesh Poyarekar
2023-10-17 15:43 ` DJ Delorie
2023-10-17 15:58 ` Siddhesh Poyarekar
2023-10-17 16:45 ` DJ Delorie
2023-10-17 16:55 ` Siddhesh Poyarekar
2023-10-17 17:14 ` DJ Delorie
2023-10-18 14:20 ` Siddhesh Poyarekar
2023-10-17 17:40 ` Zack Weinberg
2023-10-17 17:47 ` DJ Delorie
2023-10-17 18:17 ` Zack Weinberg
2023-10-17 18:21 ` DJ Delorie
2023-10-06 22:04 ` DJ Delorie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8b216d3c-5f38-3ef5-1764-8cd811936714@gotplt.org \
--to=siddhesh@gotplt.org \
--cc=adhemerval.zanella@linaro.org \
--cc=dj@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).