From: Randy Dunlap <rdunlap@infradead.org>
To: Dave Hansen <dave@sr71.net>, linux-kernel@vger.kernel.org
Cc: linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org
Subject: Re: [PATCH 1/3] kconfig: consolidate arch-specific seccomp options
Date: Mon, 13 Jan 2014 11:40:49 -0800 [thread overview]
Message-ID: <52D44141.4020304@infradead.org> (raw)
In-Reply-To: <20140102202014.CA206E9B@viggo.jf.intel.com>
On 01/02/2014 12:20 PM, Dave Hansen wrote:
> From: Dave Hansen <dave.hansen@linux.intel.com>
>
> ---
>
> linux.git-davehans/arch/arm/Kconfig | 15 +--------------
> linux.git-davehans/arch/microblaze/Kconfig | 18 +-----------------
> linux.git-davehans/arch/mips/Kconfig | 18 +-----------------
> linux.git-davehans/arch/powerpc/Kconfig | 18 +-----------------
> linux.git-davehans/arch/s390/Kconfig | 18 +-----------------
> linux.git-davehans/arch/sh/Kconfig | 17 +----------------
> linux.git-davehans/arch/sparc/Kconfig | 18 +-----------------
> linux.git-davehans/arch/x86/Kconfig | 17 +----------------
> linux.git-davehans/security/Kconfig | 21 ++++++++++++++++++++-
> 9 files changed, 28 insertions(+), 132 deletions(-)
>
> diff -puN security/Kconfig~consolidate-seccomp-options security/Kconfig
> --- linux.git/security/Kconfig~consolidate-seccomp-options 2014-01-02 11:23:58.604785905 -0800
> +++ linux.git-davehans/security/Kconfig 2014-01-02 11:23:58.614786355 -0800
> @@ -167,5 +167,24 @@ config DEFAULT_SECURITY
> default "yama" if DEFAULT_SECURITY_YAMA
> default "" if DEFAULT_SECURITY_DAC
>
> -endmenu
> +config HAVE_ARCH_SECCOMP
> + bool
> +
> +config SECCOMP
> + bool
> + default y
Prefer
def_bool y
> + prompt "Enable seccomp to safely compute untrusted bytecode"
> + ---help---
> + This kernel feature is useful for number crunching applications
> + that may need to compute untrusted bytecode during their
> + execution. By using pipes or other transports made available to
> + the process as file descriptors supporting the read/write
> + syscalls, it's possible to isolate those applications in
> + their own address space using seccomp. Once seccomp is
> + enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
> + and the task is only allowed to execute a few safe syscalls
> + defined by each seccomp mode.
>
> + If unsure, say Y. Only embedded should say N here.
> +
> +endmenu
--
~Randy
next prev parent reply other threads:[~2014-01-13 19:40 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-02 20:20 Dave Hansen
2014-01-02 20:20 ` [PATCH 2/3] Kconfig: collapse initrd in to own menu Dave Hansen
2014-01-02 20:20 ` [PATCH 3/3] Kconfig: organize memory-related config options Dave Hansen
2014-02-05 14:28 ` Michal Hocko
2014-02-05 16:27 ` Dave Hansen
2014-01-02 21:08 ` [PATCH 1/3] kconfig: consolidate arch-specific seccomp options Mimi Zohar
2014-01-02 21:14 ` Dave Hansen
2014-01-04 15:38 ` Stephen Rothwell
2014-01-04 19:04 ` Dave Hansen
2014-01-04 23:33 ` Stephen Rothwell
2014-01-05 0:41 ` Dave Hansen
2014-01-05 10:24 ` Stephen Rothwell
2014-01-13 19:40 ` Randy Dunlap [this message]
2014-01-13 20:29 ` Dave Hansen
2014-01-31 17:24 [PATCH 0/3] General Kconfig reorganization Dave Hansen
2014-01-31 17:24 ` [PATCH 1/3] kconfig: consolidate arch-specific seccomp options Dave Hansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52D44141.4020304@infradead.org \
--to=rdunlap@infradead.org \
--cc=dave@sr71.net \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome