[thirdparty/linux.git] / security / Kconfig.hardening

# SPDX-License-Identifier: GPL-2.0-only
menu "Kernel hardening options"

config GCC_PLUGIN_STRUCTLEAK
	bool
	help
	  While the kernel is built with warnings enabled for any missed
	  stack variable initializations, this warning is silenced for
	  anything passed by reference to another function, under the
	  occasionally misguided assumption that the function will do
	  the initialization. As this regularly leads to exploitable
	  flaws, this plugin is available to identify and zero-initialize
	  such variables, depending on the chosen level of coverage.

	  This plugin was originally ported from grsecurity/PaX. More
	  information at:
	   * https://grsecurity.net/
	   * https://pax.grsecurity.net/

menu "Memory initialization"

config CC_HAS_AUTO_VAR_INIT
	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)

choice
	prompt "Initialize kernel stack variables at function entry"
	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
	default INIT_STACK_ALL if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT
	default INIT_STACK_NONE
	help
	  This option enables initialization of stack variables at
	  function entry time. This has the possibility to have the
	  greatest coverage (since all functions can have their
	  variables initialized), but the performance impact depends
	  on the function calling complexity of a given workload's
	  syscalls.

	  This chooses the level of coverage over classes of potentially
	  uninitialized variables. The selected class will be
	  initialized before use in a function.

	config INIT_STACK_NONE
		bool "no automatic initialization (weakest)"
		help
		  Disable automatic stack variable initialization.
		  This leaves the kernel vulnerable to the standard
		  classes of uninitialized stack variable exploits
		  and information exposures.

	config GCC_PLUGIN_STRUCTLEAK_USER
		bool "zero-init structs marked for userspace (weak)"
		depends on GCC_PLUGINS
		select GCC_PLUGIN_STRUCTLEAK
		help
		  Zero-initialize any structures on the stack containing
		  a __user attribute. This can prevent some classes of
		  uninitialized stack variable exploits and information
		  exposures, like CVE-2013-2141:
		  https://git.kernel.org/linus/b9e146d8eb3b9eca

	config GCC_PLUGIN_STRUCTLEAK_BYREF
		bool "zero-init structs passed by reference (strong)"
		depends on GCC_PLUGINS
		depends on !(KASAN && KASAN_STACK=1)
		select GCC_PLUGIN_STRUCTLEAK
		help
		  Zero-initialize any structures on the stack that may
		  be passed by reference and had not already been
		  explicitly initialized. This can prevent most classes
		  of uninitialized stack variable exploits and information
		  exposures, like CVE-2017-1000410:
		  https://git.kernel.org/linus/06e7e776ca4d3654

		  As a side-effect, this keeps a lot of variables on the
		  stack that can otherwise be optimized out, so combining
		  this with CONFIG_KASAN_STACK can lead to a stack overflow
		  and is disallowed.

	config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
		bool "zero-init anything passed by reference (very strong)"
		depends on GCC_PLUGINS
		depends on !(KASAN && KASAN_STACK=1)
		select GCC_PLUGIN_STRUCTLEAK
		help
		  Zero-initialize any stack variables that may be passed
		  by reference and had not already been explicitly
		  initialized. This is intended to eliminate all classes
		  of uninitialized stack variable exploits and information
		  exposures.

	config INIT_STACK_ALL
		bool "0xAA-init everything on the stack (strongest)"
		depends on CC_HAS_AUTO_VAR_INIT
		help
		  Initializes everything on the stack with a 0xAA
		  pattern. This is intended to eliminate all classes
		  of uninitialized stack variable exploits and information
		  exposures, even variables that were warned to have been
		  left uninitialized.

endchoice

config GCC_PLUGIN_STRUCTLEAK_VERBOSE
	bool "Report forcefully initialized variables"
	depends on GCC_PLUGIN_STRUCTLEAK
	depends on !COMPILE_TEST	# too noisy
	help
	  This option will cause a warning to be printed each time the
	  structleak plugin finds a variable it thinks needs to be
	  initialized. Since not all existing initializers are detected
	  by the plugin, this can produce false positive warnings.

config GCC_PLUGIN_STACKLEAK
	bool "Poison kernel stack before returning from syscalls"
	depends on GCC_PLUGINS
	depends on HAVE_ARCH_STACKLEAK
	help
	  This option makes the kernel erase the kernel stack before
	  returning from system calls. This has the effect of leaving
	  the stack initialized to the poison value, which both reduces
	  the lifetime of any sensitive stack contents and reduces
	  potential for uninitialized stack variable exploits or information
	  exposures (it does not cover functions reaching the same stack
	  depth as prior functions during the same syscall). This blocks
	  most uninitialized stack variable attacks, with the performance
	  impact being driven by the depth of the stack usage, rather than
	  the function calling complexity.

	  The performance impact on a single CPU system kernel compilation
	  sees a 1% slowdown, other systems and workloads may vary and you
	  are advised to test this feature on your expected workload before
	  deploying it.

	  This plugin was ported from grsecurity/PaX. More information at:
	   * https://grsecurity.net/
	   * https://pax.grsecurity.net/

config STACKLEAK_TRACK_MIN_SIZE
	int "Minimum stack frame size of functions tracked by STACKLEAK"
	default 100
	range 0 4096
	depends on GCC_PLUGIN_STACKLEAK
	help
	  The STACKLEAK gcc plugin instruments the kernel code for tracking
	  the lowest border of the kernel stack (and for some other purposes).
	  It inserts the stackleak_track_stack() call for the functions with
	  a stack frame size greater than or equal to this parameter.
	  If unsure, leave the default value 100.

config STACKLEAK_METRICS
	bool "Show STACKLEAK metrics in the /proc file system"
	depends on GCC_PLUGIN_STACKLEAK
	depends on PROC_FS
	help
	  If this is set, STACKLEAK metrics for every task are available in
	  the /proc file system. In particular, /proc/<pid>/stack_depth
	  shows the maximum kernel stack consumption for the current and
	  previous syscalls. Although this information is not precise, it
	  can be useful for estimating the STACKLEAK performance impact for
	  your workloads.

config STACKLEAK_RUNTIME_DISABLE
	bool "Allow runtime disabling of kernel stack erasing"
	depends on GCC_PLUGIN_STACKLEAK
	help
	  This option provides 'stack_erasing' sysctl, which can be used in
	  runtime to control kernel stack erasing for kernels built with
	  CONFIG_GCC_PLUGIN_STACKLEAK.

config INIT_ON_ALLOC_DEFAULT_ON
	bool "Enable heap memory zeroing on allocation by default"
	help
	  This has the effect of setting "init_on_alloc=1" on the kernel
	  command line. This can be disabled with "init_on_alloc=0".
	  When "init_on_alloc" is enabled, all page allocator and slab
	  allocator memory will be zeroed when allocated, eliminating
	  many kinds of "uninitialized heap memory" flaws, especially
	  heap content exposures. The performance impact varies by
	  workload, but most cases see <1% impact. Some synthetic
	  workloads have measured as high as 7%.

config INIT_ON_FREE_DEFAULT_ON
	bool "Enable heap memory zeroing on free by default"
	help
	  This has the effect of setting "init_on_free=1" on the kernel
	  command line. This can be disabled with "init_on_free=0".
	  Similar to "init_on_alloc", when "init_on_free" is enabled,
	  all page allocator and slab allocator memory will be zeroed
	  when freed, eliminating many kinds of "uninitialized heap memory"
	  flaws, especially heap content exposures. The primary difference
	  with "init_on_free" is that data lifetime in memory is reduced,
	  as anything freed is wiped immediately, making live forensics or
	  cold boot memory attacks unable to recover freed memory contents.
	  The performance impact varies by workload, but is more expensive
	  than "init_on_alloc" due to the negative cache effects of
	  touching "cold" memory areas. Most cases see 3-5% impact. Some
	  synthetic workloads have measured as high as 8%.

endmenu

endmenu
Commit	Line	Data
ec8f24b7	1	# SPDX-License-Identifier: GPL-2.0-only
9f671e58 KC	2	menu "Kernel hardening options"
	3
	4	config GCC_PLUGIN_STRUCTLEAK
	5	bool
	6	help
	7	While the kernel is built with warnings enabled for any missed
	8	stack variable initializations, this warning is silenced for
	9	anything passed by reference to another function, under the
	10	occasionally misguided assumption that the function will do
	11	the initialization. As this regularly leads to exploitable
	12	flaws, this plugin is available to identify and zero-initialize
	13	such variables, depending on the chosen level of coverage.
	14
	15	This plugin was originally ported from grsecurity/PaX. More
	16	information at:
	17	* https://grsecurity.net/
	18	* https://pax.grsecurity.net/
	19
	20	menu "Memory initialization"
	21
709a972e KC	22	config CC_HAS_AUTO_VAR_INIT
	23	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
	24
9f671e58 KC	25	choice
	26	prompt "Initialize kernel stack variables at function entry"
	27	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
709a972e	28	default INIT_STACK_ALL if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT
9f671e58 KC	29	default INIT_STACK_NONE
	30	help
	31	This option enables initialization of stack variables at
	32	function entry time. This has the possibility to have the
	33	greatest coverage (since all functions can have their
	34	variables initialized), but the performance impact depends
	35	on the function calling complexity of a given workload's
	36	syscalls.
	37
	38	This chooses the level of coverage over classes of potentially
	39	uninitialized variables. The selected class will be
	40	initialized before use in a function.
	41
	42	config INIT_STACK_NONE
	43	bool "no automatic initialization (weakest)"
	44	help
	45	Disable automatic stack variable initialization.
	46	This leaves the kernel vulnerable to the standard
	47	classes of uninitialized stack variable exploits
	48	and information exposures.
	49
	50	config GCC_PLUGIN_STRUCTLEAK_USER
	51	bool "zero-init structs marked for userspace (weak)"
	52	depends on GCC_PLUGINS
	53	select GCC_PLUGIN_STRUCTLEAK
	54	help
	55	Zero-initialize any structures on the stack containing
	56	a __user attribute. This can prevent some classes of
	57	uninitialized stack variable exploits and information
	58	exposures, like CVE-2013-2141:
	59	https://git.kernel.org/linus/b9e146d8eb3b9eca
	60
	61	config GCC_PLUGIN_STRUCTLEAK_BYREF
	62	bool "zero-init structs passed by reference (strong)"
	63	depends on GCC_PLUGINS
173e6ee2	64	depends on !(KASAN && KASAN_STACK=1)
9f671e58 KC	65	select GCC_PLUGIN_STRUCTLEAK
	66	help
	67	Zero-initialize any structures on the stack that may
	68	be passed by reference and had not already been
	69	explicitly initialized. This can prevent most classes
	70	of uninitialized stack variable exploits and information
	71	exposures, like CVE-2017-1000410:
	72	https://git.kernel.org/linus/06e7e776ca4d3654
	73
173e6ee2 AB	74	As a side-effect, this keeps a lot of variables on the
	75	stack that can otherwise be optimized out, so combining
	76	this with CONFIG_KASAN_STACK can lead to a stack overflow
	77	and is disallowed.
	78
9f671e58 KC	79	config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
	80	bool "zero-init anything passed by reference (very strong)"
	81	depends on GCC_PLUGINS
173e6ee2	82	depends on !(KASAN && KASAN_STACK=1)
9f671e58 KC	83	select GCC_PLUGIN_STRUCTLEAK
	84	help
	85	Zero-initialize any stack variables that may be passed
	86	by reference and had not already been explicitly
	87	initialized. This is intended to eliminate all classes
	88	of uninitialized stack variable exploits and information
	89	exposures.
	90
709a972e KC	91	config INIT_STACK_ALL
	92	bool "0xAA-init everything on the stack (strongest)"
	93	depends on CC_HAS_AUTO_VAR_INIT
	94	help
	95	Initializes everything on the stack with a 0xAA
	96	pattern. This is intended to eliminate all classes
	97	of uninitialized stack variable exploits and information
	98	exposures, even variables that were warned to have been
	99	left uninitialized.
	100
9f671e58 KC	101	endchoice
	102
	103	config GCC_PLUGIN_STRUCTLEAK_VERBOSE
	104	bool "Report forcefully initialized variables"
	105	depends on GCC_PLUGIN_STRUCTLEAK
	106	depends on !COMPILE_TEST # too noisy
	107	help
	108	This option will cause a warning to be printed each time the
	109	structleak plugin finds a variable it thinks needs to be
	110	initialized. Since not all existing initializers are detected
	111	by the plugin, this can produce false positive warnings.
	112
b6a6a377 KC	113	config GCC_PLUGIN_STACKLEAK
	114	bool "Poison kernel stack before returning from syscalls"
	115	depends on GCC_PLUGINS
	116	depends on HAVE_ARCH_STACKLEAK
	117	help
	118	This option makes the kernel erase the kernel stack before
	119	returning from system calls. This has the effect of leaving
	120	the stack initialized to the poison value, which both reduces
	121	the lifetime of any sensitive stack contents and reduces
	122	potential for uninitialized stack variable exploits or information
	123	exposures (it does not cover functions reaching the same stack
	124	depth as prior functions during the same syscall). This blocks
	125	most uninitialized stack variable attacks, with the performance
	126	impact being driven by the depth of the stack usage, rather than
	127	the function calling complexity.
	128
	129	The performance impact on a single CPU system kernel compilation
	130	sees a 1% slowdown, other systems and workloads may vary and you
	131	are advised to test this feature on your expected workload before
	132	deploying it.
	133
	134	This plugin was ported from grsecurity/PaX. More information at:
	135	* https://grsecurity.net/
	136	* https://pax.grsecurity.net/
	137
	138	config STACKLEAK_TRACK_MIN_SIZE
	139	int "Minimum stack frame size of functions tracked by STACKLEAK"
	140	default 100
	141	range 0 4096
	142	depends on GCC_PLUGIN_STACKLEAK
	143	help
	144	The STACKLEAK gcc plugin instruments the kernel code for tracking
	145	the lowest border of the kernel stack (and for some other purposes).
	146	It inserts the stackleak_track_stack() call for the functions with
	147	a stack frame size greater than or equal to this parameter.
	148	If unsure, leave the default value 100.
	149
	150	config STACKLEAK_METRICS
	151	bool "Show STACKLEAK metrics in the /proc file system"
	152	depends on GCC_PLUGIN_STACKLEAK
	153	depends on PROC_FS
	154	help
	155	If this is set, STACKLEAK metrics for every task are available in
	156	the /proc file system. In particular, /proc/<pid>/stack_depth
	157	shows the maximum kernel stack consumption for the current and
	158	previous syscalls. Although this information is not precise, it
	159	can be useful for estimating the STACKLEAK performance impact for
	160	your workloads.
	161
	162	config STACKLEAK_RUNTIME_DISABLE
	163	bool "Allow runtime disabling of kernel stack erasing"
	164	depends on GCC_PLUGIN_STACKLEAK
	165	help
	166	This option provides 'stack_erasing' sysctl, which can be used in
	167	runtime to control kernel stack erasing for kernels built with
	168	CONFIG_GCC_PLUGIN_STACKLEAK.
	169
6471384a AP	170	config INIT_ON_ALLOC_DEFAULT_ON
	171	bool "Enable heap memory zeroing on allocation by default"
	172	help
	173	This has the effect of setting "init_on_alloc=1" on the kernel
	174	command line. This can be disabled with "init_on_alloc=0".
	175	When "init_on_alloc" is enabled, all page allocator and slab
	176	allocator memory will be zeroed when allocated, eliminating
	177	many kinds of "uninitialized heap memory" flaws, especially
	178	heap content exposures. The performance impact varies by
	179	workload, but most cases see <1% impact. Some synthetic
	180	workloads have measured as high as 7%.
	181
	182	config INIT_ON_FREE_DEFAULT_ON
	183	bool "Enable heap memory zeroing on free by default"
	184	help
	185	This has the effect of setting "init_on_free=1" on the kernel
	186	command line. This can be disabled with "init_on_free=0".
	187	Similar to "init_on_alloc", when "init_on_free" is enabled,
	188	all page allocator and slab allocator memory will be zeroed
	189	when freed, eliminating many kinds of "uninitialized heap memory"
	190	flaws, especially heap content exposures. The primary difference
	191	with "init_on_free" is that data lifetime in memory is reduced,
	192	as anything freed is wiped immediately, making live forensics or
	193	cold boot memory attacks unable to recover freed memory contents.
	194	The performance impact varies by workload, but is more expensive
	195	than "init_on_alloc" due to the negative cache effects of
	196	touching "cold" memory areas. Most cases see 3-5% impact. Some
	197	synthetic workloads have measured as high as 8%.
	198
9f671e58 KC	199	endmenu
	200
	201	endmenu