[Cc'ing a bunch more people to get input] Hi Matt,
On Wed, 7 Feb 2024 at 17:16, Matthieu Baerts <matt...@kernel.org> wrote: [...] > When talking to Jakub about the kernel config used by the new CI for the > net tree [1], Jakub suggested [2] to check if KFENCE could not be > enabled by default for x86 architecture. > > As KFENCE maintainers, what do you think about that? Do you see some > blocking points? Do you plan to add it in x86_64_defconfig? We have no concrete plans to add it to x86 defconfig. I don't think there'd be anything wrong with that from a technical point of view, but I think defconfig should remain relatively minimal. I guess different groups of people will disagree here: as kernel maintainers, it'd be a good thing because we get more coverage and higher probability of catching memory-safety bugs; as a user, I think having defconfig enable KFENCE seems unintuitive. I think this would belong into some "hardening" config - while KFENCE is not a mitigation (due to sampling) it has the performance characteristics of unintrusive hardening techniques, so I think it would be a good fit. I think that'd be "kernel/configs/hardening.config". Preferences? Thanks, -- Marco
