Re: [GIT PULL] usercopy whitelisting for v4.15-rc1

[Kees Cook]

On Fri, Nov 17, 2017 at 1:13 PM, Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> As long as you see your hardening efforts primarily as a "let me kill
> the machine/process on bad behavior", I will stop taking those shit
> patches.

Yes, this is entirely clear. This is why I adjusted this series (in
multiple places) to use WARN, etc etc. And why I went to great lengths
to document the rationale, effects, and alloc/use paths so when
something went wrong it would be easy to see what was happening and
why.

> So the hardening efforts should instead _start_ from the standpoint of
> "let's warn about what looks dangerous, and maybe in a _year_ when
> we've warned for a long time, and we are confident that we've actually
> caught all the normal cases, _then_ we can start taking more drastic
> measures".

Understood: I think my main flaw in helping bring these defenses to
the kernel has been thinking they can be fully tested during a single
development cycle, and this mistake was made quite clear this cycle,
which is why I adjusted the series like I did.

> Right now, the biggest problem for me is that the whole thing makes me
> uncomfortable, because I think the people involved are coming from a
> completely unacceptable model to begin with.
>
> And we had this exact issue with the _previous_ user mode access
> hardening. People apparently didn't learn a goddamn thing.

Well, I'd like to think I did learn something, since I fixed up this
series _before_ you yelled at me. :)

I'll make further adjustments and try again for v4.16.

-Kees

-- 
Kees Cook
Pixel Security