summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Pagano <mpagano@gentoo.org>2021-06-08 11:34:15 -0400
committerMike Pagano <mpagano@gentoo.org>2021-06-08 11:34:15 -0400
commit60251f4418deb251c34d281c76bcca0b8fb2769e (patch)
tree6208ec12e009cd0645be56662deecc091cd8cd71
parentAdd missing endmenu (diff)
downloadlinux-patches-60251f4418deb251c34d281c76bcca0b8fb2769e.tar.gz
linux-patches-60251f4418deb251c34d281c76bcca0b8fb2769e.tar.bz2
linux-patches-60251f4418deb251c34d281c76bcca0b8fb2769e.zip
CONFIG opt to enable a subset of Kernel Self Protection Project settings
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r--4567_distro-Gentoo-Kconfig.patch121
1 files changed, 115 insertions, 6 deletions
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index e754a3e6..daf29c39 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -1,14 +1,14 @@
---- a/Kconfig 2020-04-15 11:05:30.202413863 -0400
-+++ b/Kconfig 2020-04-15 10:37:45.683952949 -0400
-@@ -32,3 +32,5 @@ source "lib/Kconfig"
+--- a/Kconfig 2021-06-04 19:03:33.646823432 -0400
++++ b/Kconfig 2021-06-04 19:03:40.508892817 -0400
+@@ -30,3 +30,5 @@ source "lib/Kconfig"
source "lib/Kconfig.debug"
source "Documentation/Kconfig"
+
+source "distro/Kconfig"
---- /dev/null 2020-09-24 03:06:47.590000000 -0400
-+++ b/distro/Kconfig 2020-09-24 11:31:29.403150624 -0400
-@@ -0,0 +1,158 @@
+--- /dev/null 2021-06-06 14:01:09.950742356 -0400
++++ b/distro/Kconfig 2021-06-06 17:48:05.912077568 -0400
+@@ -0,0 +1,267 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -166,4 +166,113 @@
+
+endmenu
+
++menu "Enable Kernel Self Protection Project Recommendations"
++ visible if GENTOO_LINUX
++
++config GENTOO_KERNEL_SELF_PROTECTION
++ bool "Architecture Independant Kernel Self Protection Project Recommendations"
++
++ help
++ Recommended Kernel settings based on the suggestions from the Kernel Self Protection Project
++ See: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
++ Note, there may be additional settings for which the CONFIG_ setting is invisible in menuconfig due
++ to unmet dependencies. Search for GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for
++ dependency information on your specific architecture.
++ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
++ for X86_64
++
++ depends on GENTOO_LINUX && !HARDENED_USERCOPY_FALLBACK && !HARDENED_USERCOPY_PAGESPAN && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !DEVKMEM && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !SECURITY_SELINUX_DISABLE && !IA32_EMULATION && !X86_X32 && !MODIFY_LDT_SYSCALL
++
++
++ select BUG
++ select STRICT_KERNEL_RWX
++ select DEBUG_WX
++ select STACKPROTECTOR
++ select STACKPROTECTOR_STRONG
++ select STRICT_DEVMEM
++ select IO_STRICT_DEVMEM
++
++ select SYN_COOKIES
++ select DEBUG_CREDENTIALS
++ select DEBUG_NOTIFIERS
++ select DEBUG_LIST
++ select DEBUG_SG
++ select BUG_ON_DATA_CORRUPTION
++ select SCHED_STACK_END_CHECK
++ select SECCOMP
++ select SECCOMP_FILTER
++ select SECURITY
++ select SECURITY_YAMA
++ select HARDENED_USERCOPY
++ select SLAB_FREELIST_RANDOM
++ select SLAB_FREELIST_HARDENED
++ select SHUFFLE_PAGE_ALLOCATOR
++ select SLUB_DEBUG
++ select PAGE_POISONING
++ select PAGE_POISONING_NO_SANITY
++ select PAGE_POISONING_ZERO
++ select INIT_ON_ALLOC_DEFAULT_ON
++ select INIT_ON_FREE_DEFAULT_ON
++ select VMAP_STACK
++ select REFCOUNT_FULL
++ select FORTIFY_SOURCE
++ select SECURITY_DMESG_RESTRICT
++ select PANIC_ON_OOPS
++ select CONFIG_GCC_PLUGINS=y
++ select GCC_PLUGIN_LATENT_ENTROPY
++ select GCC_PLUGIN_STRUCTLEAK
++ select GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
++ select GCC_PLUGIN_STACKLEAK
++ select GCC_PLUGIN_RANDSTRUCT
++ select GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
++
++menu "Architecture Specific Self Protection Project Recommendations"
++
++config GENTOO_KERNEL_SELF_PROTECTION_X86_64
++ bool "X86_64 KSPP Settings"
++
++ depends on !X86_MSR && X86_64
++ default n
++
++ select RANDOMIZE_BASE
++ select RANDOMIZE_MEMORY
++ select LEGACY_VSYSCALL_NONE
++ select PAGE_TABLE_ISOLATION
++
++
++config GENTOO_KERNEL_SELF_PROTECTION_ARM64
++ bool "ARM64 KSPP Settings"
++
++ depends on ARM64
++ default n
++
++ select RANDOMIZE_BASE
++ select ARM64_SW_TTBR0_PAN
++ select CONFIG_UNMAP_KERNEL_AT_EL0
++
++config GENTOO_KERNEL_SELF_PROTECTION_X86_32
++ bool "X86_32 KSPP Settings"
++
++ depends on !X86_MSR && !MODIFY_LDT_SYSCALL && !M486 && X86_32
++ default n
++
++ select HIGHMEM64G
++ select X86_PAE
++ select RANDOMIZE_BASE
++ select PAGE_TABLE_ISOLATION
++
++config GENTOO_KERNEL_SELF_PROTECTION_ARM
++ bool "ARM KSPP Settings"
++
++ depends on !OABI_COMPAT && ARM
++ default n
++
++ select VMSPLIT_3G
++ select STRICT_MEMORY_RWX
++ select CPU_SW_DOMAIN_PAN
++
++endmenu
++
++endmenu
++
+endmenu