Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   David Laight <David.Laight@ACULAB.COM>
To:     'Nikolay Borisov' <nik.borisov@suse.com>,
        "x86@kernel.org" <x86@kernel.org>
CC:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "mhocko@suse.com" <mhocko@suse.com>,
        "jslaby@suse.cz" <jslaby@suse.cz>
Subject: RE: [PATCH v2 0/4] Make IA32_EMULATION boot time overridable
Thread-Topic: [PATCH v2 0/4] Make IA32_EMULATION boot time overridable
Thread-Index: AQHZmsNlxcUUAdbQu0asg62sJKhJ1K+Ek7Zg
Date:   Sat, 10 Jun 2023 21:46:55 +0000
Message-ID: <930ebd9ac94843129781ec208a0dd69f@AcuMS.aculab.com>
References: <20230609111311.4110901-1-nik.borisov@suse.com>
In-Reply-To: <20230609111311.4110901-1-nik.borisov@suse.com>
Accept-Language: en-GB, en-US
MIME-Version: 1.0
Content-Language: en-US
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Precedence: bulk

From: Nikolay Borisov
> Sent: 09 June 2023 12:13
> 
> Here's the 2nd version of the patch which aims to make IA32_EMULATION essentially
> a boot time option. The changes in this posting are:

Does it make any sense to be able to enable/disable it at run-time
(through a sysctl).
Perhaps only if enabled at boot - where it can be a 'soft disable'
even though the cpu is initialised to allow the 32bit system calls.

Remember, if you are root (and the system isn't hard locked down)
it is pretty easy to change a global boolean variable.
So it doesn't really affect the attack surface.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)