Commit 215199e3 authored by Kees Cook's avatar Kees Cook
Browse files

hardening: Provide Kconfig fragments for basic options 

Inspired by Salvatore Mesoraca's earlier[1] efforts to provide some
in-tree guidance for kernel hardening Kconfig options, add a new fragment
named "hardening-basic.config" (along with some arch-specific fragments)
that enable a basic set of kernel hardening options that have the least
(or no) performance impact and remove a reasonable set of legacy APIs.

Using this fragment is as simple as running "make hardening.config".

More extreme fragments can be added[2] in the future to cover all the
recognized hardening options, and more per-architecture files can be
added too.

For now, document the fragments directly via comments. Perhaps .rst
documentation can be generated from them in the future (rather than the
other way around).

[1] https://lore.kernel.org/kernel-hardening/1536516257-30871-1-git-send-email-s.mesoraca16@gmail.com/
[2] https://github.com/KSPP/linux/issues/14



Cc: Salvatore Mesoraca <s.mesoraca16@gmail.com>
Cc: x86@kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-doc@vger.kernel.org
Cc: linux-kbuild@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent ce9ecca0

MAINTAINERS

+2 −0
Original line number Diff line number Diff line
@@ -11398,8 +11398,10 @@ S: Supported 
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening

F:	Documentation/ABI/testing/sysfs-kernel-oops_count

F:	Documentation/ABI/testing/sysfs-kernel-warn_count

F:	arch/*/configs/hardening.config

F:	include/linux/overflow.h

F:	include/linux/randomize_kstack.h

F:	kernel/configs/hardening.config

F:	mm/usercopy.c

K:	\b(add|choose)_random_kstack_offset\b

K:	\b__check_(object_size|heap_object)\b

arch/arm/configs/hardening.config

0 → 100644
+7 −0
Original line number Diff line number Diff line 
# Basic kernel hardening options (specific to arm)



# Make sure PXN/PAN emulation is enabled.

CONFIG_CPU_SW_DOMAIN_PAN=y



# Dangerous; old interfaces and needless additional attack surface.

# CONFIG_OABI_COMPAT is not set

arch/arm64/configs/hardening.config

0 → 100644
+22 −0
Original line number Diff line number Diff line 
# Basic kernel hardening options (specific to arm64)



# Make sure PAN emulation is enabled.

CONFIG_ARM64_SW_TTBR0_PAN=y



# Software Shadow Stack or PAC

CONFIG_SHADOW_CALL_STACK=y



# Pointer authentication (ARMv8.3 and later). If hardware actually supports

# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.

CONFIG_ARM64_PTR_AUTH=y

CONFIG_ARM64_PTR_AUTH_KERNEL=y



# Available in ARMv8.5 and later.

CONFIG_ARM64_BTI=y

CONFIG_ARM64_BTI_KERNEL=y

CONFIG_ARM64_MTE=y

CONFIG_KASAN_HW_TAGS=y

CONFIG_ARM64_E0PD=y



# Available in ARMv8.7 and later.

CONFIG_ARM64_EPAN=y

arch/powerpc/configs/hardening.config

0 → 100644
+10 −0
Original line number Diff line number Diff line 
# PowerPC specific hardening options



# Block kernel from unexpectedly reading userspace memory.

CONFIG_PPC_KUAP=y



# Attack surface reduction.

# CONFIG_SCOM_DEBUGFS is not set



# Disable internal kernel debugger.

# CONFIG_XMON is not set

arch/x86/configs/hardening.config

0 → 100644
+15 −0
Original line number Diff line number Diff line 
# Basic kernel hardening options (specific to x86)



# Modern libc no longer needs a fixed-position mapping in userspace, remove

# it as a possible target.

CONFIG_LEGACY_VSYSCALL_NONE=y



# Enable chip-specific IOMMU support.

CONFIG_INTEL_IOMMU=y

CONFIG_INTEL_IOMMU_DEFAULT_ON=y

CONFIG_INTEL_IOMMU_SVM=y

CONFIG_AMD_IOMMU=y

CONFIG_AMD_IOMMU_V2=y



# Enable CET Shadow Stack for userspace.

CONFIG_X86_USER_SHADOW_STACK=y