On Fri, Sep 25, 2026 at 01:01:51PM +0200, David Hildenbrand (Arm) wrote: > On 9/25/26 11:53, Mike Rapoport (Microsoft) wrote: > > Verification that the kernel does not have writable + executable > > mappings is about detecting security risks rather than a pure debug > > feature. > > > > Major distribution configurations enable it in their kernels as well as > > defconfigs of most architectures that have ARCH_HAS_DEBUG_WX. > > > > Rename relevant generic configuration options to use CHECK_WX and move > > their definitions from mm/Kconfig.debug to mm/Kconfig. > > > > For arm that does not widely enable it, only rename its variants of the > > config options. > > > > Enabling CHECK_WX adds a few kilobytes to the kernel binary and while > > the added size can be slightly reduced with churny updates of > > architecture implementations of ptdump, the core functionality takes > > most of the added size. It cannot be moved to .init.text because the > > verification has to happen after init sections are freed. > > > > With this, make generic CHECK_WX default to STRICT_KERNEL_RWX while > > still leaving users targeting small kernels the possibility to opt-out. > > > > Suggested-by: Dave Hansen <[email protected]> > > Signed-off-by: Mike Rapoport (Microsoft) <[email protected]> > > --- > > Makes sense to me > > Acked-by: David Hildenbrand (Arm) <[email protected]>
Similarly LGTM so: Acked-by: Lorenzo Stoakes (ARM) <[email protected]> > > -- > Cheers, > > David -- Cheers, Lorenzo
