Skip to content

Commit 215199e

Browse files
keeskees
committed
hardening: Provide Kconfig fragments for basic options
Inspired by Salvatore Mesoraca's earlier[1] efforts to provide some in-tree guidance for kernel hardening Kconfig options, add a new fragment named "hardening-basic.config" (along with some arch-specific fragments) that enable a basic set of kernel hardening options that have the least (or no) performance impact and remove a reasonable set of legacy APIs. Using this fragment is as simple as running "make hardening.config". More extreme fragments can be added[2] in the future to cover all the recognized hardening options, and more per-architecture files can be added too. For now, document the fragments directly via comments. Perhaps .rst documentation can be generated from them in the future (rather than the other way around). [1] https://lore.kernel.org/kernel-hardening/1536516257-30871-1-git-send-email-s.mesoraca16@gmail.com/ [2] KSPP#14 Cc: Salvatore Mesoraca <s.mesoraca16@gmail.com> Cc: x86@kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-doc@vger.kernel.org Cc: linux-kbuild@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
1 parent ce9ecca commit 215199e

6 files changed

Lines changed: 154 additions & 0 deletions

File tree

‎MAINTAINERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11398,8 +11398,10 @@ S: Supported
1139811398
T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
1139911399
F: Documentation/ABI/testing/sysfs-kernel-oops_count
1140011400
F: Documentation/ABI/testing/sysfs-kernel-warn_count
11401+
F: arch/*/configs/hardening.config
1140111402
F: include/linux/overflow.h
1140211403
F: include/linux/randomize_kstack.h
11404+
F: kernel/configs/hardening.config
1140311405
F: mm/usercopy.c
1140411406
K: \b(add|choose)_random_kstack_offset\b
1140511407
K: \b__check_(object_size|heap_object)\b

‎arch/arm/configs/hardening.config‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Basic kernel hardening options (specific to arm)
2+
3+
# Make sure PXN/PAN emulation is enabled.
4+
CONFIG_CPU_SW_DOMAIN_PAN=y
5+
6+
# Dangerous; old interfaces and needless additional attack surface.
7+
# CONFIG_OABI_COMPAT is not set

‎arch/arm64/configs/hardening.config‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Basic kernel hardening options (specific to arm64)
2+
3+
# Make sure PAN emulation is enabled.
4+
CONFIG_ARM64_SW_TTBR0_PAN=y
5+
6+
# Software Shadow Stack or PAC
7+
CONFIG_SHADOW_CALL_STACK=y
8+
9+
# Pointer authentication (ARMv8.3 and later). If hardware actually supports
10+
# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
11+
CONFIG_ARM64_PTR_AUTH=y
12+
CONFIG_ARM64_PTR_AUTH_KERNEL=y
13+
14+
# Available in ARMv8.5 and later.
15+
CONFIG_ARM64_BTI=y
16+
CONFIG_ARM64_BTI_KERNEL=y
17+
CONFIG_ARM64_MTE=y
18+
CONFIG_KASAN_HW_TAGS=y
19+
CONFIG_ARM64_E0PD=y
20+
21+
# Available in ARMv8.7 and later.
22+
CONFIG_ARM64_EPAN=y

‎arch/powerpc/configs/hardening.config‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# PowerPC specific hardening options
2+
3+
# Block kernel from unexpectedly reading userspace memory.
4+
CONFIG_PPC_KUAP=y
5+
6+
# Attack surface reduction.
7+
# CONFIG_SCOM_DEBUGFS is not set
8+
9+
# Disable internal kernel debugger.
10+
# CONFIG_XMON is not set

‎arch/x86/configs/hardening.config‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Basic kernel hardening options (specific to x86)
2+
3+
# Modern libc no longer needs a fixed-position mapping in userspace, remove
4+
# it as a possible target.
5+
CONFIG_LEGACY_VSYSCALL_NONE=y
6+
7+
# Enable chip-specific IOMMU support.
8+
CONFIG_INTEL_IOMMU=y
9+
CONFIG_INTEL_IOMMU_DEFAULT_ON=y
10+
CONFIG_INTEL_IOMMU_SVM=y
11+
CONFIG_AMD_IOMMU=y
12+
CONFIG_AMD_IOMMU_V2=y
13+
14+
# Enable CET Shadow Stack for userspace.
15+
CONFIG_X86_USER_SHADOW_STACK=y

‎kernel/configs/hardening.config‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Help: Basic kernel hardening options
2+
#
3+
# These are considered the basic kernel hardening, self-protection, and
4+
# attack surface reduction options. They are expected to have low (or
5+
# no) performance impact on most workloads, and have a reasonable level
6+
# of legacy API removals.
7+
8+
# Make sure reporting of various hardening actions is possible.
9+
CONFIG_BUG=y
10+
11+
# Basic kernel memory permission enforcement.
12+
CONFIG_STRICT_KERNEL_RWX=y
13+
CONFIG_STRICT_MODULE_RWX=y
14+
CONFIG_VMAP_STACK=y
15+
16+
# Kernel image and memory ASLR.
17+
CONFIG_RANDOMIZE_BASE=y
18+
CONFIG_RANDOMIZE_MEMORY=y
19+
20+
# Randomize allocator freelists, harden metadata.
21+
CONFIG_SLAB_FREELIST_RANDOM=y
22+
CONFIG_SLAB_FREELIST_HARDENED=y
23+
CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
24+
CONFIG_RANDOM_KMALLOC_CACHES=y
25+
26+
# Randomize kernel stack offset on syscall entry.
27+
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
28+
29+
# Basic stack frame overflow protection.
30+
CONFIG_STACKPROTECTOR=y
31+
CONFIG_STACKPROTECTOR_STRONG=y
32+
33+
# Basic buffer length bounds checking.
34+
CONFIG_HARDENED_USERCOPY=y
35+
CONFIG_FORTIFY_SOURCE=y
36+
37+
# Basic array index bounds checking.
38+
CONFIG_UBSAN=y
39+
CONFIG_UBSAN_TRAP=y
40+
CONFIG_UBSAN_BOUNDS=y
41+
# CONFIG_UBSAN_SHIFT is not set
42+
# CONFIG_UBSAN_DIV_ZERO
43+
# CONFIG_UBSAN_UNREACHABLE
44+
# CONFIG_UBSAN_BOOL
45+
# CONFIG_UBSAN_ENUM
46+
# CONFIG_UBSAN_ALIGNMENT
47+
CONFIG_UBSAN_SANITIZE_ALL=y
48+
49+
# Linked list integrity checking.
50+
CONFIG_LIST_HARDENED=y
51+
52+
# Initialize all heap variables to zero on allocation.
53+
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
54+
55+
# Initialize all stack variables to zero on function entry.
56+
CONFIG_INIT_STACK_ALL_ZERO=y
57+
58+
# Wipe RAM at reboot via EFI. For more details, see:
59+
# https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/
60+
# https://bugzilla.redhat.com/show_bug.cgi?id=1532058
61+
CONFIG_RESET_ATTACK_MITIGATION=y
62+
63+
# Disable DMA between EFI hand-off and the kernel's IOMMU setup.
64+
CONFIG_EFI_DISABLE_PCI_DMA=y
65+
66+
# Force IOMMU TLB invalidation so devices will never be able to access stale
67+
# data content.
68+
CONFIG_IOMMU_SUPPORT=y
69+
CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
70+
71+
# Do not allow direct physical memory access to non-device memory.
72+
CONFIG_STRICT_DEVMEM=y
73+
CONFIG_IO_STRICT_DEVMEM=y
74+
75+
# Provide userspace with seccomp BPF API for syscall attack surface reduction.
76+
CONFIG_SECCOMP=y
77+
CONFIG_SECCOMP_FILTER=y
78+
79+
# Provides some protections against SYN flooding.
80+
CONFIG_SYN_COOKIES=y
81+
82+
# Attack surface reduction: do not autoload TTY line disciplines.
83+
# CONFIG_LDISC_AUTOLOAD is not set
84+
85+
# Dangerous; enabling this disables userspace brk ASLR.
86+
# CONFIG_COMPAT_BRK is not set
87+
88+
# Dangerous; exposes kernel text image layout.
89+
# CONFIG_PROC_KCORE is not set
90+
91+
# Dangerous; enabling this disables userspace VDSO ASLR.
92+
# CONFIG_COMPAT_VDSO is not set
93+
94+
# Attack surface reduction: Use the modern PTY interface (devpts) only.
95+
# CONFIG_LEGACY_PTYS is not set
96+
97+
# Attack surface reduction: Use only modesetting video drivers.
98+
# CONFIG_DRM_LEGACY is not set

0 commit comments

Comments
 (0)