From: Kees Cook <keescook@chromium.org>
To: Josh Triplett <josh@joshtriplett.org>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Johannes Weiner <hannes@cmpxchg.org>,
Arnd Bergmann <arnd@arndb.de>, Ingo Molnar <mingo@kernel.org>,
Andy Lutomirski <luto@kernel.org>, Petr Mladek <pmladek@suse.com>,
Thomas Garnier <thgarnie@google.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Nicolas Pitre <nicolas.pitre@linaro.org>,
Zefan Li <lizefan@huawei.com>, Li Bin <huawei.libin@huawei.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Dmitry Vyukov <dvyukov@google.com>,
Ralf Baechle <ralf@linux-mips.org>,
Alex Thorlton <athorlton@sgi.com>, Michal Hocko <mhocko@suse.com>,
Mateusz Guzik <mguzik@redhat.com>,
Cyrill Gorcunov <gorcunov@openvz.org>,
John Stultz <john.stultz@linaro.org>,
Al Viro <viro@zeniv.linux.org.uk>, Zach Brown <zab@redhat.com>,
Anna Schumaker <Anna.Schumaker@netapp.com>,
Dave Hansen <dave.hansen@intel.com>,
LKML <linux-kernel@vger.kernel.org>,
Linux API <linux-api@vger.kernel.org>
Subject: Re: [PATCH 2/2] kernel: Support compiling out the prctl syscall
Date: Tue, 8 Nov 2016 16:40:02 -0800 [thread overview]
Message-ID: <CAGXu5j+V11oF0gcqBQTsBMgetsSdRqLQffobhyEbze82gbW2vA@mail.gmail.com> (raw)
In-Reply-To: <b5c45594261252a486b891090eba8f10aa7ed329.1478650356.git-series.josh@joshtriplett.org>
On Tue, Nov 8, 2016 at 4:18 PM, Josh Triplett <josh@joshtriplett.org> wrote:
> Some embedded systems can do without the prctl syscall, saving some
> space.
>
> This also avoids regular increases in tinyconfig size as people add more
> non-optional functionality to prctl (observed via the 0-day kernel
> infrastructure).
>
> bloat-o-meter results:
>
> add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143)
> function old new delta
> offsets 23 12 -11
> prctl_set_auxv 97 - -97
> sys_prctl 794 - -794
> prctl_set_mm 1241 - -1241
> Total: Before=1902583, After=1900440, chg -0.11%
>
> Signed-off-by: Josh Triplett <josh@joshtriplett.org>
I'm absolutely a fan of doing this, but I wonder how this interacts
with the LSMs that define prctl hooks, etc. I wouldn't expect a system
that didn't want prctl to want an LSM, but maybe the LSMs all need to
depend on CONFIG_PRCTL now?
-Kees
> ---
> init/Kconfig | 12 ++++++++++++
> kernel/Makefile | 3 ++-
> kernel/sys_ni.c | 1 +
> 3 files changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/init/Kconfig b/init/Kconfig
> index 34407f1..1dd671c 100644
> --- a/init/Kconfig
> +++ b/init/Kconfig
> @@ -1408,6 +1408,18 @@ config MULTIUSER
>
> If unsure, say Y here.
>
> +config PRCTL
> + bool "prctl syscall" if EXPERT
> + default y
> + help
> + This option enables the prctl syscall, used for a variety of
> + operations on the current process.
> +
> + If building an embedded system where no applications or libraries use
> + prctl, you can disable this option to save space.
> +
> + If unsure, say Y here.
> +
> config SGETMASK_SYSCALL
> bool "sgetmask/ssetmask syscalls support" if EXPERT
> def_bool PARISC || MN10300 || BLACKFIN || M68K || PPC || MIPS || X86 || SPARC || CRIS || MICROBLAZE || SUPERH
> diff --git a/kernel/Makefile b/kernel/Makefile
> index 37c6d4c..43fb4ca 100644
> --- a/kernel/Makefile
> +++ b/kernel/Makefile
> @@ -9,9 +9,10 @@ obj-y = fork.o exec_domain.o panic.o \
> extable.o params.o \
> kthread.o sys_ni.o nsproxy.o \
> notifier.o ksysfs.o cred.o reboot.o \
> - async.o range.o smpboot.o ucount.o prctl.o
> + async.o range.o smpboot.o ucount.o
>
> obj-$(CONFIG_MULTIUSER) += groups.o
> +obj-$(CONFIG_PRCTL) += prctl.o
>
> ifdef CONFIG_FUNCTION_TRACER
> # Do not trace internal ftrace files
> diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
> index 635482e..84fd646 100644
> --- a/kernel/sys_ni.c
> +++ b/kernel/sys_ni.c
> @@ -175,6 +175,7 @@ cond_syscall(sys_setfsgid);
> cond_syscall(sys_capget);
> cond_syscall(sys_capset);
> cond_syscall(sys_copy_file_range);
> +cond_syscall(sys_prctl);
>
> /* arch-specific weak syscall entries */
> cond_syscall(sys_pciconfig_read);
> --
> git-series 0.8.11
--
Kees Cook
Nexus Security
next prev parent reply other threads:[~2016-11-09 0:40 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-09 0:17 [PATCH 0/2] Support compiling out the prctl syscall Josh Triplett
2016-11-09 0:18 ` [PATCH 1/2] kernel: Move prctl and helpers from kernel/sys.c to new kernel/prctl.c Josh Triplett
2016-11-09 0:19 ` Andy Lutomirski
2016-11-09 7:02 ` Cyrill Gorcunov
2016-11-09 0:18 ` [PATCH 2/2] kernel: Support compiling out the prctl syscall Josh Triplett
2016-11-09 0:40 ` Kees Cook [this message]
2016-11-09 0:47 ` Josh Triplett
2016-11-09 0:56 ` Kees Cook
2016-11-09 1:08 ` Josh Triplett
2016-11-09 0:26 ` [PATCH 0/2] " Arnd Bergmann
2016-11-09 3:42 ` Josh Triplett
2016-11-09 0:30 ` Nicolas Pitre
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAGXu5j+V11oF0gcqBQTsBMgetsSdRqLQffobhyEbze82gbW2vA@mail.gmail.com \
--to=keescook@chromium.org \
--cc=Anna.Schumaker@netapp.com \
--cc=akpm@linux-foundation.org \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=athorlton@sgi.com \
--cc=dave.hansen@intel.com \
--cc=dvyukov@google.com \
--cc=ebiederm@xmission.com \
--cc=gorcunov@openvz.org \
--cc=hannes@cmpxchg.org \
--cc=huawei.libin@huawei.com \
--cc=john.stultz@linaro.org \
--cc=josh@joshtriplett.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=luto@kernel.org \
--cc=mguzik@redhat.com \
--cc=mhocko@suse.com \
--cc=mingo@kernel.org \
--cc=nicolas.pitre@linaro.org \
--cc=pmladek@suse.com \
--cc=ralf@linux-mips.org \
--cc=thgarnie@google.com \
--cc=viro@zeniv.linux.org.uk \
--cc=zab@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).