KSPP future in defconf linux distribution.

[bryn1u]

Hello,

Im just curious what is the status of implementing KSPP to default kernel of linux GNU distribution ? Why linux distributions dont impelment for example most of kspp solutions for example steackleak or gcc hardeneing ? I use most of kspp feature based on your script Alexander and kernel works like a charm. Someone can explain to me ?

[Bernhard40]

Some settings may affect performance, debugability, support for older userspace software, etc.

[a13xp0p0v]

Some settings may affect performance, debugability, support for older userspace software, etc.

I agree.
Moreover, kernel self-protection features often give different performance penalty for different kinds of workload. It's difficult to find one kernel configuration that makes everyone happy.

I think Linux distributions could provide several kernel flavours for different purposes (e.g. generic, hardened, low-latency), to improve the situation.

I'm sure @kees has more insights about this.

[kees]

Yup! There is an open bug with KSPP to provide a defconfig fragment selection interface to the upstream kernel. You can see more details here:
KSPP/linux#14

[bryn1u]

Okey. Thanks guys for your work and explanation.