Kernel Self Protection Project: slub_debug=ZF
Peter Gerber <[email protected]>
| Newsgroups | com.openwall.lists.kernel-hardening |
|---|---|
| Message-ID | <[email protected]> |
Hello, The Kernel Self Protection Project, on their Recommended Settings [1] page, suggests the following: # Enable SLUB redzoning and sanity checking (slow; requires CONFIG_SLUB_DEBUG=y above). slub_debug=ZF On recent kernels, I see the following in dmesg when this option is set: ********************************************************** ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** ** ** ** This system shows unhashed kernel memory addresses ** ** via the console, logs, and other interfaces. This ** ** might reduce the security of your system. ** ** ** ** If you see this message and you are not debugging ** ** the kernel, report this immediately to your system ** ** administrator! ** ** ** ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** ********************************************************** A bit of digging tells me that this is caused by "slub: force on no_hash_pointers when slub_debug is enabled" [2]. Assuming the performance impact is acceptable, is this option still recommend? Should there perhaps be a way to explicitly disable no_hash_pointers (e.g. via no_hash_pointers=off)? Regards, Peter [1]: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings [2]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=792702911f581f7793962fbeb99d5c3a1b28f4c3