tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Kernel hardening options"
3
4config GCC_PLUGIN_STRUCTLEAK
5 bool
6 help
7 While the kernel is built with warnings enabled for any missed
8 stack variable initializations, this warning is silenced for
9 anything passed by reference to another function, under the
10 occasionally misguided assumption that the function will do
11 the initialization. As this regularly leads to exploitable
12 flaws, this plugin is available to identify and zero-initialize
13 such variables, depending on the chosen level of coverage.
14
15 This plugin was originally ported from grsecurity/PaX. More
16 information at:
17 * https://grsecurity.net/
18 * https://pax.grsecurity.net/
19
20menu "Memory initialization"
21
22config CC_HAS_AUTO_VAR_INIT_PATTERN
23 def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
24
25config CC_HAS_AUTO_VAR_INIT_ZERO_BARE
26 def_bool $(cc-option,-ftrivial-auto-var-init=zero)
27
28config CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
29 # Clang 16 and later warn about using the -enable flag, but it
30 # is required before then.
31 def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
32 depends on !CC_HAS_AUTO_VAR_INIT_ZERO_BARE
33
34config CC_HAS_AUTO_VAR_INIT_ZERO
35 def_bool CC_HAS_AUTO_VAR_INIT_ZERO_BARE || CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
36
37choice
38 prompt "Initialize kernel stack variables at function entry"
39 default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
40 default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
41 default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
42 default INIT_STACK_NONE
43 help
44 This option enables initialization of stack variables at
45 function entry time. This has the possibility to have the
46 greatest coverage (since all functions can have their
47 variables initialized), but the performance impact depends
48 on the function calling complexity of a given workload's
49 syscalls.
50
51 This chooses the level of coverage over classes of potentially
52 uninitialized variables. The selected class of variable will be
53 initialized before use in a function.
54
55 config INIT_STACK_NONE
56 bool "no automatic stack variable initialization (weakest)"
57 help
58 Disable automatic stack variable initialization.
59 This leaves the kernel vulnerable to the standard
60 classes of uninitialized stack variable exploits
61 and information exposures.
62
63 config GCC_PLUGIN_STRUCTLEAK_USER
64 bool "zero-init structs marked for userspace (weak)"
65 # Plugin can be removed once the kernel only supports GCC 12+
66 depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO
67 select GCC_PLUGIN_STRUCTLEAK
68 help
69 Zero-initialize any structures on the stack containing
70 a __user attribute. This can prevent some classes of
71 uninitialized stack variable exploits and information
72 exposures, like CVE-2013-2141:
73 https://git.kernel.org/linus/b9e146d8eb3b9eca
74
75 config GCC_PLUGIN_STRUCTLEAK_BYREF
76 bool "zero-init structs passed by reference (strong)"
77 # Plugin can be removed once the kernel only supports GCC 12+
78 depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO
79 depends on !(KASAN && KASAN_STACK)
80 select GCC_PLUGIN_STRUCTLEAK
81 help
82 Zero-initialize any structures on the stack that may
83 be passed by reference and had not already been
84 explicitly initialized. This can prevent most classes
85 of uninitialized stack variable exploits and information
86 exposures, like CVE-2017-1000410:
87 https://git.kernel.org/linus/06e7e776ca4d3654
88
89 As a side-effect, this keeps a lot of variables on the
90 stack that can otherwise be optimized out, so combining
91 this with CONFIG_KASAN_STACK can lead to a stack overflow
92 and is disallowed.
93
94 config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
95 bool "zero-init everything passed by reference (very strong)"
96 # Plugin can be removed once the kernel only supports GCC 12+
97 depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO
98 depends on !(KASAN && KASAN_STACK)
99 select GCC_PLUGIN_STRUCTLEAK
100 help
101 Zero-initialize any stack variables that may be passed
102 by reference and had not already been explicitly
103 initialized. This is intended to eliminate all classes
104 of uninitialized stack variable exploits and information
105 exposures.
106
107 As a side-effect, this keeps a lot of variables on the
108 stack that can otherwise be optimized out, so combining
109 this with CONFIG_KASAN_STACK can lead to a stack overflow
110 and is disallowed.
111
112 config INIT_STACK_ALL_PATTERN
113 bool "pattern-init everything (strongest)"
114 depends on CC_HAS_AUTO_VAR_INIT_PATTERN
115 depends on !KMSAN
116 help
117 Initializes everything on the stack (including padding)
118 with a specific debug value. This is intended to eliminate
119 all classes of uninitialized stack variable exploits and
120 information exposures, even variables that were warned about
121 having been left uninitialized.
122
123 Pattern initialization is known to provoke many existing bugs
124 related to uninitialized locals, e.g. pointers receive
125 non-NULL values, buffer sizes and indices are very big. The
126 pattern is situation-specific; Clang on 64-bit uses 0xAA
127 repeating for all types and padding except float and double
128 which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF
129 repeating for all types and padding.
130 GCC uses 0xFE repeating for all types, and zero for padding.
131
132 config INIT_STACK_ALL_ZERO
133 bool "zero-init everything (strongest and safest)"
134 depends on CC_HAS_AUTO_VAR_INIT_ZERO
135 depends on !KMSAN
136 help
137 Initializes everything on the stack (including padding)
138 with a zero value. This is intended to eliminate all
139 classes of uninitialized stack variable exploits and
140 information exposures, even variables that were warned
141 about having been left uninitialized.
142
143 Zero initialization provides safe defaults for strings
144 (immediately NUL-terminated), pointers (NULL), indices
145 (index 0), and sizes (0 length), so it is therefore more
146 suitable as a production security mitigation than pattern
147 initialization.
148
149endchoice
150
151config GCC_PLUGIN_STRUCTLEAK_VERBOSE
152 bool "Report forcefully initialized variables"
153 depends on GCC_PLUGIN_STRUCTLEAK
154 depends on !COMPILE_TEST # too noisy
155 help
156 This option will cause a warning to be printed each time the
157 structleak plugin finds a variable it thinks needs to be
158 initialized. Since not all existing initializers are detected
159 by the plugin, this can produce false positive warnings.
160
161config GCC_PLUGIN_STACKLEAK
162 bool "Poison kernel stack before returning from syscalls"
163 depends on GCC_PLUGINS
164 depends on HAVE_ARCH_STACKLEAK
165 help
166 This option makes the kernel erase the kernel stack before
167 returning from system calls. This has the effect of leaving
168 the stack initialized to the poison value, which both reduces
169 the lifetime of any sensitive stack contents and reduces
170 potential for uninitialized stack variable exploits or information
171 exposures (it does not cover functions reaching the same stack
172 depth as prior functions during the same syscall). This blocks
173 most uninitialized stack variable attacks, with the performance
174 impact being driven by the depth of the stack usage, rather than
175 the function calling complexity.
176
177 The performance impact on a single CPU system kernel compilation
178 sees a 1% slowdown, other systems and workloads may vary and you
179 are advised to test this feature on your expected workload before
180 deploying it.
181
182 This plugin was ported from grsecurity/PaX. More information at:
183 * https://grsecurity.net/
184 * https://pax.grsecurity.net/
185
186config GCC_PLUGIN_STACKLEAK_VERBOSE
187 bool "Report stack depth analysis instrumentation" if EXPERT
188 depends on GCC_PLUGIN_STACKLEAK
189 depends on !COMPILE_TEST # too noisy
190 help
191 This option will cause a warning to be printed each time the
192 stackleak plugin finds a function it thinks needs to be
193 instrumented. This is useful for comparing coverage between
194 builds.
195
196config STACKLEAK_TRACK_MIN_SIZE
197 int "Minimum stack frame size of functions tracked by STACKLEAK"
198 default 100
199 range 0 4096
200 depends on GCC_PLUGIN_STACKLEAK
201 help
202 The STACKLEAK gcc plugin instruments the kernel code for tracking
203 the lowest border of the kernel stack (and for some other purposes).
204 It inserts the stackleak_track_stack() call for the functions with
205 a stack frame size greater than or equal to this parameter.
206 If unsure, leave the default value 100.
207
208config STACKLEAK_METRICS
209 bool "Show STACKLEAK metrics in the /proc file system"
210 depends on GCC_PLUGIN_STACKLEAK
211 depends on PROC_FS
212 help
213 If this is set, STACKLEAK metrics for every task are available in
214 the /proc file system. In particular, /proc/<pid>/stack_depth
215 shows the maximum kernel stack consumption for the current and
216 previous syscalls. Although this information is not precise, it
217 can be useful for estimating the STACKLEAK performance impact for
218 your workloads.
219
220config STACKLEAK_RUNTIME_DISABLE
221 bool "Allow runtime disabling of kernel stack erasing"
222 depends on GCC_PLUGIN_STACKLEAK
223 help
224 This option provides 'stack_erasing' sysctl, which can be used in
225 runtime to control kernel stack erasing for kernels built with
226 CONFIG_GCC_PLUGIN_STACKLEAK.
227
228config INIT_ON_ALLOC_DEFAULT_ON
229 bool "Enable heap memory zeroing on allocation by default"
230 depends on !KMSAN
231 help
232 This has the effect of setting "init_on_alloc=1" on the kernel
233 command line. This can be disabled with "init_on_alloc=0".
234 When "init_on_alloc" is enabled, all page allocator and slab
235 allocator memory will be zeroed when allocated, eliminating
236 many kinds of "uninitialized heap memory" flaws, especially
237 heap content exposures. The performance impact varies by
238 workload, but most cases see <1% impact. Some synthetic
239 workloads have measured as high as 7%.
240
241config INIT_ON_FREE_DEFAULT_ON
242 bool "Enable heap memory zeroing on free by default"
243 depends on !KMSAN
244 help
245 This has the effect of setting "init_on_free=1" on the kernel
246 command line. This can be disabled with "init_on_free=0".
247 Similar to "init_on_alloc", when "init_on_free" is enabled,
248 all page allocator and slab allocator memory will be zeroed
249 when freed, eliminating many kinds of "uninitialized heap memory"
250 flaws, especially heap content exposures. The primary difference
251 with "init_on_free" is that data lifetime in memory is reduced,
252 as anything freed is wiped immediately, making live forensics or
253 cold boot memory attacks unable to recover freed memory contents.
254 The performance impact varies by workload, but is more expensive
255 than "init_on_alloc" due to the negative cache effects of
256 touching "cold" memory areas. Most cases see 3-5% impact. Some
257 synthetic workloads have measured as high as 8%.
258
259config CC_HAS_ZERO_CALL_USED_REGS
260 def_bool $(cc-option,-fzero-call-used-regs=used-gpr)
261 # https://github.com/ClangBuiltLinux/linux/issues/1766
262 # https://github.com/llvm/llvm-project/issues/59242
263 depends on !CC_IS_CLANG || CLANG_VERSION > 150006
264
265config ZERO_CALL_USED_REGS
266 bool "Enable register zeroing on function exit"
267 depends on CC_HAS_ZERO_CALL_USED_REGS
268 help
269 At the end of functions, always zero any caller-used register
270 contents. This helps ensure that temporary values are not
271 leaked beyond the function boundary. This means that register
272 contents are less likely to be available for side channels
273 and information exposures. Additionally, this helps reduce the
274 number of useful ROP gadgets by about 20% (and removes compiler
275 generated "write-what-where" gadgets) in the resulting kernel
276 image. This has a less than 1% performance impact on most
277 workloads. Image size growth depends on architecture, and should
278 be evaluated for suitability. For example, x86_64 grows by less
279 than 1%, and arm64 grows by about 5%.
280
281endmenu
282
283menu "Hardening of kernel data structures"
284
285config LIST_HARDENED
286 bool "Check integrity of linked list manipulation"
287 help
288 Minimal integrity checking in the linked-list manipulation routines
289 to catch memory corruptions that are not guaranteed to result in an
290 immediate access fault.
291
292 If unsure, say N.
293
294config BUG_ON_DATA_CORRUPTION
295 bool "Trigger a BUG when data corruption is detected"
296 select LIST_HARDENED
297 help
298 Select this option if the kernel should BUG when it encounters
299 data corruption in kernel memory structures when they get checked
300 for validity.
301
302 If unsure, say N.
303
304endmenu
305
306config CC_HAS_RANDSTRUCT
307 def_bool $(cc-option,-frandomize-layout-seed-file=/dev/null)
308 # Randstruct was first added in Clang 15, but it isn't safe to use until
309 # Clang 16 due to https://github.com/llvm/llvm-project/issues/60349
310 depends on !CC_IS_CLANG || CLANG_VERSION >= 160000
311
312choice
313 prompt "Randomize layout of sensitive kernel structures"
314 default RANDSTRUCT_FULL if COMPILE_TEST && (GCC_PLUGINS || CC_HAS_RANDSTRUCT)
315 default RANDSTRUCT_NONE
316 help
317 If you enable this, the layouts of structures that are entirely
318 function pointers (and have not been manually annotated with
319 __no_randomize_layout), or structures that have been explicitly
320 marked with __randomize_layout, will be randomized at compile-time.
321 This can introduce the requirement of an additional information
322 exposure vulnerability for exploits targeting these structure
323 types.
324
325 Enabling this feature will introduce some performance impact,
326 slightly increase memory usage, and prevent the use of forensic
327 tools like Volatility against the system (unless the kernel
328 source tree isn't cleaned after kernel installation).
329
330 The seed used for compilation is in scripts/basic/randomize.seed.
331 It remains after a "make clean" to allow for external modules to
332 be compiled with the existing seed and will be removed by a
333 "make mrproper" or "make distclean". This file should not be made
334 public, or the structure layout can be determined.
335
336 config RANDSTRUCT_NONE
337 bool "Disable structure layout randomization"
338 help
339 Build normally: no structure layout randomization.
340
341 config RANDSTRUCT_FULL
342 bool "Fully randomize structure layout"
343 depends on CC_HAS_RANDSTRUCT || GCC_PLUGINS
344 select MODVERSIONS if MODULES && !COMPILE_TEST
345 help
346 Fully randomize the member layout of sensitive
347 structures as much as possible, which may have both a
348 memory size and performance impact.
349
350 One difference between the Clang and GCC plugin
351 implementations is the handling of bitfields. The GCC
352 plugin treats them as fully separate variables,
353 introducing sometimes significant padding. Clang tries
354 to keep adjacent bitfields together, but with their bit
355 ordering randomized.
356
357 config RANDSTRUCT_PERFORMANCE
358 bool "Limit randomization of structure layout to cache-lines"
359 depends on GCC_PLUGINS
360 select MODVERSIONS if MODULES && !COMPILE_TEST
361 help
362 Randomization of sensitive kernel structures will make a
363 best effort at restricting randomization to cacheline-sized
364 groups of members. It will further not randomize bitfields
365 in structures. This reduces the performance hit of RANDSTRUCT
366 at the cost of weakened randomization.
367endchoice
368
369config RANDSTRUCT
370 def_bool !RANDSTRUCT_NONE
371
372config GCC_PLUGIN_RANDSTRUCT
373 def_bool GCC_PLUGINS && RANDSTRUCT
374 help
375 Use GCC plugin to randomize structure layout.
376
377 This plugin was ported from grsecurity/PaX. More
378 information at:
379 * https://grsecurity.net/
380 * https://pax.grsecurity.net/
381
382endmenu