On Tue, 15 Jan 2019 11:47:27 -0800
Laura Abbott <labbott(a)redhat.com> wrote:
On 1/15/19 8:51 AM, stan wrote:
> I compiled a custom fedora 5.0 kernel, and one of the new options
> was to have the kernel zero the stack on return from kernel
> functions. The cost was about 1% on a single cpu system. I made
> the judgement that this would be great on cloud servers, but wasn't
> really necessary for a local machine. Is there a reason it might
> be good for a local machine to have this enabled?
I'm guessing you're referring to CONFIG_GCC_PLUGIN_STACKLEAK. It
really depends on what you want to prevent with this option. The goal
is to prevent leaking of sensitive stack data (e.g. keys). You're
right that cloud based servers would see more benefit but I could see
you wanting this enabled on certain high value local machines. If
there is a particular machine that you would _really_ rather not get
compromised, it might be worth enabling.
Yes, that is the option I was referring to. I think I'll leave it off,
not because I don't consider my machine high value, but because I don't
have any internet accessible services running. I think the only access
from the web to my machine would be through the browser. If my machine
is compromised enough through that channel that someone is able to read
the kernel stack, I think reading the kernel stack will be beside the
point.
Also for the record, CONFIG_GCC_PLUGIN_STACKLEAK isn't on in
Fedora
officially because we don't currently enable any gcc plugins.
It's something we might look into in the future though.
This is good to know for future reference.
Thanks.