Bug #17236
Enable the init_on_alloc=1 and init_on_free=1 Linux options
0%
Description
- https://outflux.net/blog/archives/2019/11/14/security-things-in-linux-v5-3/
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef
We should normally have done this when upgrading to Linux 5.3, but Kees’ blog post was not published yet back then.
Subtasks
Related issues
Related to Tails - |
Resolved | ||
Related to Tails - |
Resolved | ||
Blocks Tails - Feature #16209: Core work: Foundations Team | Confirmed |
History
#1 Updated by intrigeri 2019-11-15 09:26:38
- related to
Bug #17124: Install Linux 5.3 from sid added
#2 Updated by intrigeri 2019-11-15 09:26:49
- related to
Bug #17177: Greeter has no option to 'Show Passphrase' anymore added
#3 Updated by intrigeri 2019-11-15 09:26:54
- related to
Bug #17117: Upgrade to Linux 5.3 added
#4 Updated by intrigeri 2019-11-15 09:27:00
- related to deleted (
)Bug #17177: Greeter has no option to 'Show Passphrase' anymore
#5 Updated by intrigeri 2019-11-15 09:27:09
- blocks Feature #16209: Core work: Foundations Team added
#6 Updated by intrigeri 2019-11-16 08:26:05
- Status changed from Confirmed to In Progress
Applied in changeset commit:tails|6aec55afe525b2a941f12a95dd5c32b8222b83f8.
#7 Updated by intrigeri 2019-11-16 08:27:07
- Feature Branch set to feature/17236-heap-variable-initialization+force-all-tests
#8 Updated by intrigeri 2019-11-16 18:10:36
No performance nor robustness regression spotted on my local Jenkins.
#9 Updated by intrigeri 2019-11-17 05:09:54
The first 2 test suite runs on lizard each expose at least one occurrence of “Remote shell seems to be down” (smells bad to me), but no performance regression.
#10 Updated by intrigeri 2019-11-27 09:04:39
- Target version changed from Tails_4.1 to Tails_4.2
This can totally wait a bit and it’s now a bit too late in the 4.1 cycle for me to feel comfortable including this.
#11 Updated by intrigeri 2019-12-28 15:16:52
- Subject changed from Consider enabling the init_on_alloc=1 and init_on_free=1 Linux options to Enable the init_on_alloc=1 and init_on_free=1 Linux options
- Status changed from In Progress to Needs Validation
- Assignee deleted (
intrigeri) - Type of work changed from Test to Code
The 7-25% performance hit with init_on_free=1
is not noticeable on Jenkins: recent test suite runs on this branch took about the same time as devel. I think that’s because we already have page poisoning and SLUB poisoning enabled, so the actual impact of init_on_free=1
is much more limited than it would otherwise be, as https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef says:
> If either SLUB poisoning or page poisoning is enabled, those options take
> precedence over init_on_alloc
and init_on_free
: initialization is only
> applied to unpoisoned allocations.
Jenkins test suite results are not more brittle than on the devel branch.
#12 Updated by intrigeri 2020-01-05 19:01:27
- Status changed from Needs Validation to In Progress
Applied in changeset commit:tails|360a8abc3ae2c2c8ffa0cf93ec5c617c77dbacb2.
#13 Updated by intrigeri 2020-01-06 07:56:55
- Status changed from In Progress to Resolved
Someone (segfault, I guess :) merged a rebased version of this branch into stable ⇒ closing.