Date: Sun, 30 Oct 2005 17:44:42 -0500 From: Adam McDougall <mcdouga9@egr.msu.edu> To: Nate Lawson <nate@root.org> Cc: cvs-src@freebsd.org, src-committers@freebsd.org, cvs-all@freebsd.org Subject: Re: cvs commit: src/sys/i386/conf DEFAULTS GENERIC Message-ID: <20051030224442.GV2998@egr.msu.edu> In-Reply-To: <436509D5.3020401@root.org> References: <200510271734.j9RHYZAk015054@repoman.freebsd.org> <20051030062148.GA76667@dragon.NUXI.org> <20051030105647.GR99857@submonkey.net> <436509D5.3020401@root.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Oct 30, 2005 at 09:58:45AM -0800, Nate Lawson wrote: Ceri Davies wrote: >On Sat, Oct 29, 2005 at 11:21:48PM -0700, David O'Brien wrote: > >>On Thu, Oct 27, 2005 at 05:34:35PM +0000, John Baldwin wrote: >> >>>jhb 2005-10-27 17:34:35 UTC >>> >>> FreeBSD src repository >>> >>> Modified files: >>> sys/i386/conf GENERIC >>> Added files: >>> sys/i386/conf DEFAULTS >>> Log: >>> Create a default kernel config for i386 and move 'device isa' and >>> 'device npx' (both of which aren't really optional right now) and >>> 'device io' and 'device mem' (to preserve POLA for 4.x users upgrading >>> to 6.0) from GENERIC into DEFAULTS. >> >>I may be missing something. I don't quite follow the benefit of the new >>'DEFAULTS' file. I'm also curious why we don't explicitly 'include' >>DEFAULTS in GENERIC vs. the new automagic include feature. > > >I was also confused by that. There are also no warnings if DEFAULTS is >missing, which means that by removing a seemingly unrelated file I get a >different (read: useless to me) kernel. Does INCLUDE_CONFIG_FILE show >the contents of DEFAULTS as well? A better way would be to make io and mem only compile time options (default to on). There is no benefit to them being modules. Anyone who wants to compile with NO_DEVIO or NO_DEVMEM will know why their kernel stops working. FWIW, I appreciate that mem can be a kernel module because that means I can have one less thing in my kernel that might (historically) lead to a root exploit, yet I can load it on whim if I already have root for things such as netstat and lsof on a server not running X. Similar for procfs on a system that occasionally wants to run truss. I like the idea of not leaving open access to kernel interfaces that have a history of abuse. It provides a single extra layer of protection while not requiring the hassle of recompiling the kernel or clamping down the ability of loading any kernel modules at all (securelevel, syscall modification). A drawback of modifying or deleting DEFAULTS is I expect it to come back the next time I cvsup, removing my changes. -- Nate _______________________________________________ cvs-src@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/cvs-src To unsubscribe, send any mail to "cvs-src-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051030224442.GV2998>