Messages in this thread | | | From | Andy Lutomirski <> | Date | Tue, 21 Jul 2015 13:27:43 -0700 | Subject | Re: [PATCH v2 2/3] x86/ldt: Make modify_ldt optional |
| |
On Tue, Jul 21, 2015 at 1:20 PM, Sasha Levin <sasha.levin@oracle.com> wrote: > On 07/21/2015 03:59 PM, Andy Lutomirski wrote: >> The modify_ldt syscall exposes a large attack surface and is >> unnecessary for modern userspace. Make it optional. > > Since this a "default y" option I think we need to make the > implications of this a bit clearer.
Do you mean improving the help text? To be clear, there's no change on a non-EXPERT of default EXPERT kernel here.
> > Do we know what userspace would break?
Some Wine and some DOSEMU most likely. Also many of the exploits I've written over the past year or two :)
> > Maybe add a WARN_ONCE() in a stub syscall? >
I think if we do that then we should do it for all the syscall disabling things.
--Andy
| |