Commit 4c56d9f7 authored by Kees Cook's avatar Kees Cook
Browse files

configs/hardening: Enable CONFIG_KSTACK_ERASE 

Since we can wipe the stack with both Clang and GCC plugins, enable this
for the "hardening.config" for wider testing.

Link: https://lore.kernel.org/r/20250717232519.2984886-12-kees@kernel.org


Signed-off-by: default avatarKees Cook <kees@kernel.org>
parent 76261fc7

kernel/configs/hardening.config

+3 −0
Original line number Diff line number Diff line
@@ -63,6 +63,9 @@ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y 
# Initialize all stack variables to zero on function entry.

CONFIG_INIT_STACK_ALL_ZERO=y



# Wipe kernel stack after syscall completion to reduce stale data lifetime.

CONFIG_KSTACK_ERASE=y



# Wipe RAM at reboot via EFI. For more details, see:

# https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/

# https://bugzilla.redhat.com/show_bug.cgi?id=1532058