Re: [PATCH] sysctl: add config to make randomize_va_space RO
From: David Hildenbrand
Date: Fri May 05 2023 - 03:37:00 EST
On 04.05.23 23:30, Michael McCracken wrote:
Add config RO_RANDMAP_SYSCTL to set the mode of the randomize_va_space
sysctl to 0444 to disallow all runtime changes. This will prevent
accidental changing of this value by a root service.
The config is disabled by default to avoid surprises.
Can you elaborate why we care about "accidental changing of this value
by a root service"?
We cannot really stop root from doing a lot of stupid things (e.g.,
erase the root fs), so why do we particularly care here?
--
Thanks,
David / dhildenb