Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <20180123230545.jufkdgttxe4eiswf@pd.tnic>
References: <1515707194-20531-1-git-send-email-dwmw@amazon.co.uk>
 <1515707194-20531-5-git-send-email-dwmw@amazon.co.uk> <20180123224014.dsbzps4hydt6h7ed@pd.tnic>
 <nycvar.YFH.7.76.1801232348060.11852@cbobk.fhfr.pm> <20180123230545.jufkdgttxe4eiswf@pd.tnic>
From:   Kees Cook <keescook@google.com>
Date:   Wed, 24 Jan 2018 11:32:00 +1100
Message-ID: <CAGXu5jKQfb8qUnJk-DMMSZS8JW8dsEuG0NQ3ihbLiCP50kLp5w@mail.gmail.com>
Subject: Re: [PATCH v8 04/12] x86/spectre: Add boot time option to select
 Spectre v2 mitigation
To:     Borislav Petkov <bp@alien8.de>
Cc:     Jiri Kosina <jikos@kernel.org>,
        David Woodhouse <dwmw@amazon.co.uk>,
        Andi Kleen <ak@linux.intel.com>, Paul Turner <pjt@google.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Greg Kroah-Hartman <gregkh@linux-foundation.org>,
        Tim Chen <tim.c.chen@linux.intel.com>,
        Dave Hansen <dave.hansen@intel.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Rik van Riel <riel@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Andy Lutomirski <luto@amacapital.net>,
        Alan Cox <gnomes@lxorguk.ukuu.org.uk>, X86 ML <x86@kernel.org>,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Josh Poimboeuf <jpoimboe@redhat.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Jan 24, 2018 at 10:05 AM, Borislav Petkov <bp@alien8.de> wrote:
> On Tue, Jan 23, 2018 at 11:55:05PM +0100, Jiri Kosina wrote:
>> I think we should start recording CFLAGS the kernel has been compiled with
>> anyway; doesn't hurt and might come handy when debugging.
>>
>> /proc/version is probably not the best place ... /proc/cflags?
>
> Yap, I guess I can find that string with hexdump on the kernel binary too :-)

I've wanted this for a while (especially for the coming detected
support for stack protector). Having more than just the clfags is, I
think, important. We'd likely want to record the entire environment
(compiler version, linker version, flags on both, etc).

-Kees

-- 
Kees Cook
Pixel Security