Current-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Compiling PAX support in Xen dom0+domU



On Thu, Dec 17, 2009 at 12:41:26AM +0100, Jean-Yves Migeon wrote:
> Dear lists,
>
> Would anyone object if PaX support (ASLR and mprotect) is compiled in by  
> default for Xen dom0 and domU? This would bring the Xen kernels closer  
> to what native x86 provide in terms of exploit mitigation.
>
> Kernels will get bigger by ~4k. sysctl, paxctl(8) usage would be the  
> exact same as for native i386 and amd64.
>
> See security(8) if you want to know what PaX is.

No objection from me. Just make sure the kernel still works with
PaX enabled :)

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--


Home | Main Index | Thread Index | Old Index