Re: [PATCH v2] kernel: add panic_on_taint

2020-05-09 Thread Rafael Aquini
On Sat, May 09, 2020 at 03:48:54AM +, Luis Chamberlain wrote: > On Fri, May 08, 2020 at 08:47:19AM -0400, Rafael Aquini wrote: > > On Thu, May 07, 2020 at 10:25:58PM +, Luis Chamberlain wrote: > > > On Thu, May 07, 2020 at 06:06:06PM -0400, Rafael Aquini wrote: > > > > On Thu, May 07, 2020

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-08 Thread Luis Chamberlain
On Fri, May 08, 2020 at 08:47:19AM -0400, Rafael Aquini wrote: > On Thu, May 07, 2020 at 10:25:58PM +, Luis Chamberlain wrote: > > On Thu, May 07, 2020 at 06:06:06PM -0400, Rafael Aquini wrote: > > > On Thu, May 07, 2020 at 08:33:40PM +, Luis Chamberlain wrote: > > > > I *think* that a

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-08 Thread Rafael Aquini
On Thu, May 07, 2020 at 10:25:58PM +, Luis Chamberlain wrote: > On Thu, May 07, 2020 at 06:06:06PM -0400, Rafael Aquini wrote: > > On Thu, May 07, 2020 at 08:33:40PM +, Luis Chamberlain wrote: > > > I *think* that a cmdline route to enable this would likely remove the > > > need for the

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Luis Chamberlain
On Thu, May 07, 2020 at 06:06:06PM -0400, Rafael Aquini wrote: > On Thu, May 07, 2020 at 08:33:40PM +, Luis Chamberlain wrote: > > I *think* that a cmdline route to enable this would likely remove the > > need for the kernel config for this. But even with Vlastimil's work > > merged, I think

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Rafael Aquini
On Thu, May 07, 2020 at 08:33:40PM +, Luis Chamberlain wrote: > On Thu, May 07, 2020 at 02:47:05PM -0400, Rafael Aquini wrote: > > On Thu, May 07, 2020 at 02:43:16PM -0400, Rafael Aquini wrote: > > > On Thu, May 07, 2020 at 06:22:57PM +, Luis Chamberlain wrote: > > > > On Thu, May 07, 2020

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Luis Chamberlain
On Thu, May 07, 2020 at 02:47:05PM -0400, Rafael Aquini wrote: > On Thu, May 07, 2020 at 02:43:16PM -0400, Rafael Aquini wrote: > > On Thu, May 07, 2020 at 06:22:57PM +, Luis Chamberlain wrote: > > > On Thu, May 07, 2020 at 02:06:31PM -0400, Rafael Aquini wrote: > > > > diff --git

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Rafael Aquini
On Thu, May 07, 2020 at 06:50:46PM +, Luis Chamberlain wrote: > On Thu, May 07, 2020 at 02:06:31PM -0400, Rafael Aquini wrote: > > Another, perhaps less frequent, use for this option would be > > as a mean for assuring a security policy (in paranoid mode) > > case where no single taint is

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Luis Chamberlain
On Thu, May 07, 2020 at 02:06:31PM -0400, Rafael Aquini wrote: > Another, perhaps less frequent, use for this option would be > as a mean for assuring a security policy (in paranoid mode) > case where no single taint is allowed for the running system. If used for this purpose then we must add a

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Rafael Aquini
On Thu, May 07, 2020 at 02:43:16PM -0400, Rafael Aquini wrote: > On Thu, May 07, 2020 at 06:22:57PM +, Luis Chamberlain wrote: > > On Thu, May 07, 2020 at 02:06:31PM -0400, Rafael Aquini wrote: > > > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > > > index 8a176d8727a3..b80ab660d727 100644 >

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Rafael Aquini
On Thu, May 07, 2020 at 06:22:57PM +, Luis Chamberlain wrote: > On Thu, May 07, 2020 at 02:06:31PM -0400, Rafael Aquini wrote: > > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > > index 8a176d8727a3..b80ab660d727 100644 > > --- a/kernel/sysctl.c > > +++ b/kernel/sysctl.c > > @@ -1217,6

Re: [PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Luis Chamberlain
On Thu, May 07, 2020 at 02:06:31PM -0400, Rafael Aquini wrote: > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > index 8a176d8727a3..b80ab660d727 100644 > --- a/kernel/sysctl.c > +++ b/kernel/sysctl.c > @@ -1217,6 +1217,13 @@ static struct ctl_table kern_table[] = { > .extra1

[PATCH v2] kernel: add panic_on_taint

2020-05-07 Thread Rafael Aquini
Analogously to the introduction of panic_on_warn, this patch introduces a kernel option named panic_on_taint in order to provide a simple and generic way to stop execution and catch a coredump when the kernel gets tainted by any given taint flag. This is useful for debugging sessions as it avoids