security: Create "kernel hardening" config area

Right now kernel hardening options are scattered around various Kconfig files. This can be a central place to collect these kinds of options going forward. This is initially populated with the memory initialization options from the gcc-plugins.

Kees Cook committed 7 years ago

Commit 9f671e51 parent 8c2ffd93 files · +101 −69Browse files

Unified · Split

3 files

scripts/gcc-plugins/Kconfig +6 −69
security/Kconfig +2 −0
security/Kconfig.hardening +93 −0

scripts/gcc-plugins/Kconfig+6−69

@@ -13,17 +13,19 @@ config HAVE_GCC_PLUGINS · 12 unmodified lines
13	An arch should select this symbol if it supports building with	13	An arch should select this symbol if it supports building with
14	GCC plugins.	14	GCC plugins.
15		15
16	menuconfig GCC_PLUGINS	16	config GCC_PLUGINS
17	bool "GCC plugins"	17	bool
18	depends on HAVE_GCC_PLUGINS	18	depends on HAVE_GCC_PLUGINS
19	depends on PLUGIN_HOSTCC != ""	19	depends on PLUGIN_HOSTCC != ""
		20	default y
20	help	21	help
21	GCC plugins are loadable modules that provide extra features to the	22	GCC plugins are loadable modules that provide extra features to the
22	compiler. They are useful for runtime instrumentation and static analysis.	23	compiler. They are useful for runtime instrumentation and static analysis.
23		24
24	See Documentation/gcc-plugins.txt for details.	25	See Documentation/gcc-plugins.txt for details.
25		26
26	if GCC_PLUGINS	27	menu "GCC plugins"
		28	depends on GCC_PLUGINS
27		29
28	config GCC_PLUGIN_CYC_COMPLEXITY	30	config GCC_PLUGIN_CYC_COMPLEXITY
29	bool "Compute the cyclomatic complexity of a function" if EXPERT	31	bool "Compute the cyclomatic complexity of a function" if EXPERT
@@ -66,71 +68,6 @@ config GCC_PLUGIN_LATENT_ENTROPY · 36 unmodified lines
66	* https://grsecurity.net/	68	* https://grsecurity.net/
67	* https://pax.grsecurity.net/	69	* https://pax.grsecurity.net/
68		70
69	config GCC_PLUGIN_STRUCTLEAK
70	bool "Zero initialize stack variables"
71	help
72	While the kernel is built with warnings enabled for any missed
73	stack variable initializations, this warning is silenced for
74	anything passed by reference to another function, under the
75	occasionally misguided assumption that the function will do
76	the initialization. As this regularly leads to exploitable
77	flaws, this plugin is available to identify and zero-initialize
78	such variables, depending on the chosen level of coverage.
79
80	This plugin was originally ported from grsecurity/PaX. More
81	information at:
82	* https://grsecurity.net/
83	* https://pax.grsecurity.net/
84
85	choice
86	prompt "Coverage"
87	depends on GCC_PLUGIN_STRUCTLEAK
88	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
89	help
90	This chooses the level of coverage over classes of potentially
91	uninitialized variables. The selected class will be
92	zero-initialized before use.
93
94	config GCC_PLUGIN_STRUCTLEAK_USER
95	bool "structs marked for userspace"
96	help
97	Zero-initialize any structures on the stack containing
98	a __user attribute. This can prevent some classes of
99	uninitialized stack variable exploits and information
100	exposures, like CVE-2013-2141:
101	https://git.kernel.org/linus/b9e146d8eb3b9eca
102
103	config GCC_PLUGIN_STRUCTLEAK_BYREF
104	bool "structs passed by reference"
105	help
106	Zero-initialize any structures on the stack that may
107	be passed by reference and had not already been
108	explicitly initialized. This can prevent most classes
109	of uninitialized stack variable exploits and information
110	exposures, like CVE-2017-1000410:
111	https://git.kernel.org/linus/06e7e776ca4d3654
112
113	config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
114	bool "anything passed by reference"
115	help
116	Zero-initialize any stack variables that may be passed
117	by reference and had not already been explicitly
118	initialized. This is intended to eliminate all classes
119	of uninitialized stack variable exploits and information
120	exposures.
121
122	endchoice
123
124	config GCC_PLUGIN_STRUCTLEAK_VERBOSE
125	bool "Report forcefully initialized variables"
126	depends on GCC_PLUGIN_STRUCTLEAK
127	depends on !COMPILE_TEST # too noisy
128	help
129	This option will cause a warning to be printed each time the
130	structleak plugin finds a variable it thinks needs to be
131	initialized. Since not all existing initializers are detected
132	by the plugin, this can produce false positive warnings.
133
134	config GCC_PLUGIN_RANDSTRUCT	71	config GCC_PLUGIN_RANDSTRUCT
135	bool "Randomize layout of sensitive kernel structures"	72	bool "Randomize layout of sensitive kernel structures"
136	select MODVERSIONS if MODULES	73	select MODVERSIONS if MODULES
@@ -226,4 +163,4 @@ config GCC_PLUGIN_ARM_SSP_PER_TASK · 89 unmodified lines
226	bool	163	bool
227	depends on GCC_PLUGINS && ARM	164	depends on GCC_PLUGINS && ARM
228		165
229	endif	166	endmenu

security/Kconfig+2−0

@@ -249,5 +249,7 @@ config LSM · 248 unmodified lines
249		249
250	If unsure, leave this as the default.	250	If unsure, leave this as the default.
251		251
		252	source "security/Kconfig.hardening"
		253
252	endmenu	254	endmenu
253		255

security/Kconfig.hardening+93−0

@@ -0,0 +1,93 @@
	1	menu "Kernel hardening options"
	2
	3	config GCC_PLUGIN_STRUCTLEAK
	4	bool
	5	help
	6	While the kernel is built with warnings enabled for any missed
	7	stack variable initializations, this warning is silenced for
	8	anything passed by reference to another function, under the
	9	occasionally misguided assumption that the function will do
	10	the initialization. As this regularly leads to exploitable
	11	flaws, this plugin is available to identify and zero-initialize
	12	such variables, depending on the chosen level of coverage.
	13
	14	This plugin was originally ported from grsecurity/PaX. More
	15	information at:
	16	* https://grsecurity.net/
	17	* https://pax.grsecurity.net/
	18
	19	menu "Memory initialization"
	20
	21	choice
	22	prompt "Initialize kernel stack variables at function entry"
	23	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
	24	default INIT_STACK_NONE
	25	help
	26	This option enables initialization of stack variables at
	27	function entry time. This has the possibility to have the
	28	greatest coverage (since all functions can have their
	29	variables initialized), but the performance impact depends
	30	on the function calling complexity of a given workload's
	31	syscalls.
	32
	33	This chooses the level of coverage over classes of potentially
	34	uninitialized variables. The selected class will be
	35	initialized before use in a function.
	36
	37	config INIT_STACK_NONE
	38	bool "no automatic initialization (weakest)"
	39	help
	40	Disable automatic stack variable initialization.
	41	This leaves the kernel vulnerable to the standard
	42	classes of uninitialized stack variable exploits
	43	and information exposures.
	44
	45	config GCC_PLUGIN_STRUCTLEAK_USER
	46	bool "zero-init structs marked for userspace (weak)"
	47	depends on GCC_PLUGINS
	48	select GCC_PLUGIN_STRUCTLEAK
	49	help
	50	Zero-initialize any structures on the stack containing
	51	a __user attribute. This can prevent some classes of
	52	uninitialized stack variable exploits and information
	53	exposures, like CVE-2013-2141:
	54	https://git.kernel.org/linus/b9e146d8eb3b9eca
	55
	56	config GCC_PLUGIN_STRUCTLEAK_BYREF
	57	bool "zero-init structs passed by reference (strong)"
	58	depends on GCC_PLUGINS
	59	select GCC_PLUGIN_STRUCTLEAK
	60	help
	61	Zero-initialize any structures on the stack that may
	62	be passed by reference and had not already been
	63	explicitly initialized. This can prevent most classes
	64	of uninitialized stack variable exploits and information
	65	exposures, like CVE-2017-1000410:
	66	https://git.kernel.org/linus/06e7e776ca4d3654
	67
	68	config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
	69	bool "zero-init anything passed by reference (very strong)"
	70	depends on GCC_PLUGINS
	71	select GCC_PLUGIN_STRUCTLEAK
	72	help
	73	Zero-initialize any stack variables that may be passed
	74	by reference and had not already been explicitly
	75	initialized. This is intended to eliminate all classes
	76	of uninitialized stack variable exploits and information
	77	exposures.
	78
	79	endchoice
	80
	81	config GCC_PLUGIN_STRUCTLEAK_VERBOSE
	82	bool "Report forcefully initialized variables"
	83	depends on GCC_PLUGIN_STRUCTLEAK
	84	depends on !COMPILE_TEST # too noisy
	85	help
	86	This option will cause a warning to be printed each time the
	87	structleak plugin finds a variable it thinks needs to be
	88	initialized. Since not all existing initializers are detected
	89	by the plugin, this can produce false positive warnings.
	90
	91	endmenu
	92
	93	endmenu