diff options
| author | Nikolay Borisov <nik.borisov@suse.com> | 2023-06-23 13:14:09 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2023-09-14 13:19:53 +0200 |
| commit | a11e097504ac1889b35b6858f495565838325f88 (patch) | |
| tree | 29b1e60da1b2f02f8641da78cf2f116535971480 /Documentation | |
| parent | x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (diff) | |
| download | linux-a11e097504ac1889b35b6858f495565838325f88.tar.xz linux-a11e097504ac1889b35b6858f495565838325f88.zip | |
x86: Make IA32_EMULATION boot time configurable
Distributions would like to reduce their attack surface as much as
possible but at the same time they'd want to retain flexibility to cater
to a variety of legacy software. This stems from the conjecture that
compat layer is likely rarely tested and could have latent security
bugs. Ideally distributions will set their default policy and also
give users the ability to override it as appropriate.
To enable this use case, introduce CONFIG_IA32_EMULATION_DEFAULT_DISABLED
compile time option, which controls whether 32bit processes/syscalls
should be allowed or not. This option is aimed mainly at distributions
to set their preferred default behavior in their kernels.
To allow users to override the distro's policy, introduce the 'ia32_emulation'
parameter which allows overriding CONFIG_IA32_EMULATION_DEFAULT_DISABLED
state at boot time.
Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230623111409.3047467-7-nik.borisov@suse.com
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/admin-guide/kernel-parameters.txt | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 0a1731a0f0ef..45e34be4ed56 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1893,6 +1893,12 @@ 0 -- machine default 1 -- force brightness inversion + ia32_emulation= [X86-64] + Format: <bool> + When true, allows loading 32-bit programs and executing 32-bit + syscalls, essentially overriding IA32_EMULATION_DEFAULT_DISABLED at + boot time. When false, unconditionally disables IA32 emulation. + icn= [HW,ISDN] Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]] |