Messages in this thread | | | Date | Fri, 13 Dec 2013 10:14:42 -0800 | Subject | Re: [PATCH 1/9] Known exploit detection | From | Linus Torvalds <> |
| |
On Fri, Dec 13, 2013 at 9:58 AM, Kees Cook <keescook@chromium.org> wrote: > > These locations tend to be very hard to reach accidentally
Not necessarily.
Don't get me wrong - I think that it's a good idea to at least have the option to complain about certain errors, and leave markers in the logs about things that look suspicious.
But looking through the recent list of commits that explicitly mention a CVE, the only one I find where a syslog message would make sense is the HID validation ones. There, adding a warning about malicious HID devices sounds like a good idea.
But a *lot* of the rest is just checking ranges or making sure we have proper string handling etc that just wouldn't be practical to check. So the error itself may be "hard to reach accidentally", but *checking* it would be so complex/painful that it would likely just introduce more room for bugs.
So I think the "WARNING" thing is a good idea, but I think it is a good idea if it's used very judiciously. IOW, not for "random CVE" (because quite frankly, most of them seem to be utter shit), but for serious known issues. And for those issues *only*.
If I start seeing patches adding warnings "just because there's a CVE", then I'm not in the least interested. But if there is some known root-kit or similar, then by all means..
Linus
| |