From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754732AbbHCSY2 (ORCPT ); Mon, 3 Aug 2015 14:24:28 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:35535 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753896AbbHCSY1 (ORCPT ); Mon, 3 Aug 2015 14:24:27 -0400 From: Willy Tarreau To: Andy Lutomirski , Kees Cook Cc: Willy Tarreau , Steven Rostedt , "security@kernel.org" , X86 ML , Borislav Petkov , Sasha Levin , LKML , Konrad Rzeszutek Wilk , Boris Ostrovsky , Andrew Cooper , Jan Beulich , xen-devel Subject: [PATCH 0/2] x86: allow to enable/disable modify_ldt at run time Date: Mon, 3 Aug 2015 20:23:35 +0200 Message-Id: <1438626217-23970-1-git-send-email-w@1wt.eu> X-Mailer: git-send-email 1.7.12.2.21.g234cd45.dirty Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is the second version. It adds a strategy for the sysctls so that we can reject any change to a value that was already negative. This way it's possible to disable modify_ldt temporarily or permanently (eg: lock down a server) as suggested by Kees. Willy Tarreau (2): sysctl: add a new generic strategy to make permanent changes on negative values x86/ldt: allow to disable modify_ldt at runtime Documentation/sysctl/kernel.txt | 16 +++++++++++++ arch/x86/Kconfig | 17 ++++++++++++++ arch/x86/kernel/ldt.c | 15 +++++++++++++ kernel/sysctl.c | 50 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 98 insertions(+) -- 1.7.12.1