Right now kernel hardening options are scattered around various Kconfig files. This can be a central place to collect these kinds of options going forward. This is initially populated with the memory initialization options from the gcc-plugins.
Showing the changes to scripts (1 of 3 files). Show all
Unified · Split
| @@ -13,17 +13,19 @@ config HAVE_GCC_PLUGINS · 12 unmodified lines | |||
| 13 | An arch should select this symbol if it supports building with | 13 | An arch should select this symbol if it supports building with |
| 14 | GCC plugins. | 14 | GCC plugins. |
| 15 | 15 | ||
| 16 | menuconfig GCC_PLUGINS | 16 | config GCC_PLUGINS |
| 17 | bool "GCC plugins" | 17 | bool |
| 18 | depends on HAVE_GCC_PLUGINS | 18 | depends on HAVE_GCC_PLUGINS |
| 19 | depends on PLUGIN_HOSTCC != "" | 19 | depends on PLUGIN_HOSTCC != "" |
| 20 | default y | ||
| 20 | help | 21 | help |
| 21 | GCC plugins are loadable modules that provide extra features to the | 22 | GCC plugins are loadable modules that provide extra features to the |
| 22 | compiler. They are useful for runtime instrumentation and static analysis. | 23 | compiler. They are useful for runtime instrumentation and static analysis. |
| 23 | 24 | ||
| 24 | See Documentation/gcc-plugins.txt for details. | 25 | See Documentation/gcc-plugins.txt for details. |
| 25 | 26 | ||
| 26 | if GCC_PLUGINS | 27 | menu "GCC plugins" |
| 28 | depends on GCC_PLUGINS | ||
| 27 | 29 | ||
| 28 | config GCC_PLUGIN_CYC_COMPLEXITY | 30 | config GCC_PLUGIN_CYC_COMPLEXITY |
| 29 | bool "Compute the cyclomatic complexity of a function" if EXPERT | 31 | bool "Compute the cyclomatic complexity of a function" if EXPERT |
| @@ -66,71 +68,6 @@ config GCC_PLUGIN_LATENT_ENTROPY · 36 unmodified lines | |||
| 66 | * https://grsecurity.net/ | 68 | * https://grsecurity.net/ |
| 67 | * https://pax.grsecurity.net/ | 69 | * https://pax.grsecurity.net/ |
| 68 | 70 | ||
| 69 | config GCC_PLUGIN_STRUCTLEAK | ||
| 70 | bool "Zero initialize stack variables" | ||
| 71 | help | ||
| 72 | While the kernel is built with warnings enabled for any missed | ||
| 73 | stack variable initializations, this warning is silenced for | ||
| 74 | anything passed by reference to another function, under the | ||
| 75 | occasionally misguided assumption that the function will do | ||
| 76 | the initialization. As this regularly leads to exploitable | ||
| 77 | flaws, this plugin is available to identify and zero-initialize | ||
| 78 | such variables, depending on the chosen level of coverage. | ||
| 79 | |||
| 80 | This plugin was originally ported from grsecurity/PaX. More | ||
| 81 | information at: | ||
| 82 | * https://grsecurity.net/ | ||
| 83 | * https://pax.grsecurity.net/ | ||
| 84 | |||
| 85 | choice | ||
| 86 | prompt "Coverage" | ||
| 87 | depends on GCC_PLUGIN_STRUCTLEAK | ||
| 88 | default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | ||
| 89 | help | ||
| 90 | This chooses the level of coverage over classes of potentially | ||
| 91 | uninitialized variables. The selected class will be | ||
| 92 | zero-initialized before use. | ||
| 93 | |||
| 94 | config GCC_PLUGIN_STRUCTLEAK_USER | ||
| 95 | bool "structs marked for userspace" | ||
| 96 | help | ||
| 97 | Zero-initialize any structures on the stack containing | ||
| 98 | a __user attribute. This can prevent some classes of | ||
| 99 | uninitialized stack variable exploits and information | ||
| 100 | exposures, like CVE-2013-2141: | ||
| 101 | https://git.kernel.org/linus/b9e146d8eb3b9eca | ||
| 102 | |||
| 103 | config GCC_PLUGIN_STRUCTLEAK_BYREF | ||
| 104 | bool "structs passed by reference" | ||
| 105 | help | ||
| 106 | Zero-initialize any structures on the stack that may | ||
| 107 | be passed by reference and had not already been | ||
| 108 | explicitly initialized. This can prevent most classes | ||
| 109 | of uninitialized stack variable exploits and information | ||
| 110 | exposures, like CVE-2017-1000410: | ||
| 111 | https://git.kernel.org/linus/06e7e776ca4d3654 | ||
| 112 | |||
| 113 | config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | ||
| 114 | bool "anything passed by reference" | ||
| 115 | help | ||
| 116 | Zero-initialize any stack variables that may be passed | ||
| 117 | by reference and had not already been explicitly | ||
| 118 | initialized. This is intended to eliminate all classes | ||
| 119 | of uninitialized stack variable exploits and information | ||
| 120 | exposures. | ||
| 121 | |||
| 122 | endchoice | ||
| 123 | |||
| 124 | config GCC_PLUGIN_STRUCTLEAK_VERBOSE | ||
| 125 | bool "Report forcefully initialized variables" | ||
| 126 | depends on GCC_PLUGIN_STRUCTLEAK | ||
| 127 | depends on !COMPILE_TEST # too noisy | ||
| 128 | help | ||
| 129 | This option will cause a warning to be printed each time the | ||
| 130 | structleak plugin finds a variable it thinks needs to be | ||
| 131 | initialized. Since not all existing initializers are detected | ||
| 132 | by the plugin, this can produce false positive warnings. | ||
| 133 | |||
| 134 | config GCC_PLUGIN_RANDSTRUCT | 71 | config GCC_PLUGIN_RANDSTRUCT |
| 135 | bool "Randomize layout of sensitive kernel structures" | 72 | bool "Randomize layout of sensitive kernel structures" |
| 136 | select MODVERSIONS if MODULES | 73 | select MODVERSIONS if MODULES |
| @@ -226,4 +163,4 @@ config GCC_PLUGIN_ARM_SSP_PER_TASK · 89 unmodified lines | |||
| 226 | bool | 163 | bool |
| 227 | depends on GCC_PLUGINS && ARM | 164 | depends on GCC_PLUGINS && ARM |
| 228 | 165 | ||
| 229 | endif | 166 | endmenu |