Kernel Self Protection Project: slub_debug=ZF

Peter Gerber <[email protected]>
Newsgroups com.openwall.lists.kernel-hardening
Message-ID <[email protected]>
Hello,

The Kernel Self Protection Project, on their Recommended Settings [1] 
page, suggests the following:

# Enable SLUB redzoning and sanity checking (slow; requires 
CONFIG_SLUB_DEBUG=y above).
slub_debug=ZF

On recent kernels, I see the following in dmesg when this option is set:

**********************************************************
**   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
**                                                      **
** This system shows unhashed kernel memory addresses   **
** via the console, logs, and other interfaces. This    **
** might reduce the security of your system.            **
**                                                      **
** If you see this message and you are not debugging    **
** the kernel, report this immediately to your system   **
** administrator!                                       **
**                                                      **
**   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
**********************************************************

A bit of digging tells me that this is caused by "slub: force on 
no_hash_pointers when slub_debug is enabled" [2]. Assuming the 
performance impact is acceptable, is this option still recommend? Should 
there perhaps be a way to explicitly disable no_hash_pointers (e.g. via 
no_hash_pointers=off)?

Regards,

Peter

[1]: 
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
[2]: 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=792702911f581f7793962fbeb99d5c3a1b28f4c3
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.