Re: [PATCH] hardening: Enable KFENCE in the hardening config

2024-02-12 Thread Kees Cook
On Mon, Feb 12, 2024 at 02:01:09PM +0100, Marco Elver wrote: > KFENCE is not a security mitigation mechanism (due to sampling), but has > the performance characteristics of unintrusive hardening techniques. > When used at scale, however, it improves overall security by allowing > kernel developers

Re: [PATCH] hardening: Enable KFENCE in the hardening config

2024-02-12 Thread Matthieu Baerts
Hi Marco, On 12/02/2024 14:01, Marco Elver wrote: > KFENCE is not a security mitigation mechanism (due to sampling), but has > the performance characteristics of unintrusive hardening techniques. > When used at scale, however, it improves overall security by allowing > kernel developers to detect

[PATCH] hardening: Enable KFENCE in the hardening config

2024-02-12 Thread Marco Elver
KFENCE is not a security mitigation mechanism (due to sampling), but has the performance characteristics of unintrusive hardening techniques. When used at scale, however, it improves overall security by allowing kernel developers to detect heap memory-safety bugs cheaply. Link: https://lkml.kernel