xref: /openbmc/linux/security/Kconfig.hardening (revision 349f631d)
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Kernel hardening options"
3
4config GCC_PLUGIN_STRUCTLEAK
5	bool
6	help
7	  While the kernel is built with warnings enabled for any missed
8	  stack variable initializations, this warning is silenced for
9	  anything passed by reference to another function, under the
10	  occasionally misguided assumption that the function will do
11	  the initialization. As this regularly leads to exploitable
12	  flaws, this plugin is available to identify and zero-initialize
13	  such variables, depending on the chosen level of coverage.
14
15	  This plugin was originally ported from grsecurity/PaX. More
16	  information at:
17	   * https://grsecurity.net/
18	   * https://pax.grsecurity.net/
19
20menu "Memory initialization"
21
22config CC_HAS_AUTO_VAR_INIT_PATTERN
23	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
24
25config CC_HAS_AUTO_VAR_INIT_ZERO
26	def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
27
28choice
29	prompt "Initialize kernel stack variables at function entry"
30	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
31	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
32	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
33	default INIT_STACK_NONE
34	help
35	  This option enables initialization of stack variables at
36	  function entry time. This has the possibility to have the
37	  greatest coverage (since all functions can have their
38	  variables initialized), but the performance impact depends
39	  on the function calling complexity of a given workload's
40	  syscalls.
41
42	  This chooses the level of coverage over classes of potentially
43	  uninitialized variables. The selected class of variable will be
44	  initialized before use in a function.
45
46	config INIT_STACK_NONE
47		bool "no automatic stack variable initialization (weakest)"
48		help
49		  Disable automatic stack variable initialization.
50		  This leaves the kernel vulnerable to the standard
51		  classes of uninitialized stack variable exploits
52		  and information exposures.
53
54	config GCC_PLUGIN_STRUCTLEAK_USER
55		bool "zero-init structs marked for userspace (weak)"
56		depends on GCC_PLUGINS
57		select GCC_PLUGIN_STRUCTLEAK
58		help
59		  Zero-initialize any structures on the stack containing
60		  a __user attribute. This can prevent some classes of
61		  uninitialized stack variable exploits and information
62		  exposures, like CVE-2013-2141:
63		  https://git.kernel.org/linus/b9e146d8eb3b9eca
64
65	config GCC_PLUGIN_STRUCTLEAK_BYREF
66		bool "zero-init structs passed by reference (strong)"
67		depends on GCC_PLUGINS
68		depends on !(KASAN && KASAN_STACK)
69		select GCC_PLUGIN_STRUCTLEAK
70		help
71		  Zero-initialize any structures on the stack that may
72		  be passed by reference and had not already been
73		  explicitly initialized. This can prevent most classes
74		  of uninitialized stack variable exploits and information
75		  exposures, like CVE-2017-1000410:
76		  https://git.kernel.org/linus/06e7e776ca4d3654
77
78		  As a side-effect, this keeps a lot of variables on the
79		  stack that can otherwise be optimized out, so combining
80		  this with CONFIG_KASAN_STACK can lead to a stack overflow
81		  and is disallowed.
82
83	config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
84		bool "zero-init everything passed by reference (very strong)"
85		depends on GCC_PLUGINS
86		depends on !(KASAN && KASAN_STACK)
87		select GCC_PLUGIN_STRUCTLEAK
88		help
89		  Zero-initialize any stack variables that may be passed
90		  by reference and had not already been explicitly
91		  initialized. This is intended to eliminate all classes
92		  of uninitialized stack variable exploits and information
93		  exposures.
94
95		  As a side-effect, this keeps a lot of variables on the
96		  stack that can otherwise be optimized out, so combining
97		  this with CONFIG_KASAN_STACK can lead to a stack overflow
98		  and is disallowed.
99
100	config INIT_STACK_ALL_PATTERN
101		bool "pattern-init everything (strongest)"
102		depends on CC_HAS_AUTO_VAR_INIT_PATTERN
103		help
104		  Initializes everything on the stack (including padding)
105		  with a specific debug value. This is intended to eliminate
106		  all classes of uninitialized stack variable exploits and
107		  information exposures, even variables that were warned about
108		  having been left uninitialized.
109
110		  Pattern initialization is known to provoke many existing bugs
111		  related to uninitialized locals, e.g. pointers receive
112		  non-NULL values, buffer sizes and indices are very big. The
113		  pattern is situation-specific; Clang on 64-bit uses 0xAA
114		  repeating for all types and padding except float and double
115		  which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF
116		  repeating for all types and padding.
117
118	config INIT_STACK_ALL_ZERO
119		bool "zero-init everything (strongest and safest)"
120		depends on CC_HAS_AUTO_VAR_INIT_ZERO
121		help
122		  Initializes everything on the stack (including padding)
123		  with a zero value. This is intended to eliminate all
124		  classes of uninitialized stack variable exploits and
125		  information exposures, even variables that were warned
126		  about having been left uninitialized.
127
128		  Zero initialization provides safe defaults for strings
129		  (immediately NUL-terminated), pointers (NULL), indices
130		  (index 0), and sizes (0 length), so it is therefore more
131		  suitable as a production security mitigation than pattern
132		  initialization.
133
134endchoice
135
136config GCC_PLUGIN_STRUCTLEAK_VERBOSE
137	bool "Report forcefully initialized variables"
138	depends on GCC_PLUGIN_STRUCTLEAK
139	depends on !COMPILE_TEST	# too noisy
140	help
141	  This option will cause a warning to be printed each time the
142	  structleak plugin finds a variable it thinks needs to be
143	  initialized. Since not all existing initializers are detected
144	  by the plugin, this can produce false positive warnings.
145
146config GCC_PLUGIN_STACKLEAK
147	bool "Poison kernel stack before returning from syscalls"
148	depends on GCC_PLUGINS
149	depends on HAVE_ARCH_STACKLEAK
150	help
151	  This option makes the kernel erase the kernel stack before
152	  returning from system calls. This has the effect of leaving
153	  the stack initialized to the poison value, which both reduces
154	  the lifetime of any sensitive stack contents and reduces
155	  potential for uninitialized stack variable exploits or information
156	  exposures (it does not cover functions reaching the same stack
157	  depth as prior functions during the same syscall). This blocks
158	  most uninitialized stack variable attacks, with the performance
159	  impact being driven by the depth of the stack usage, rather than
160	  the function calling complexity.
161
162	  The performance impact on a single CPU system kernel compilation
163	  sees a 1% slowdown, other systems and workloads may vary and you
164	  are advised to test this feature on your expected workload before
165	  deploying it.
166
167	  This plugin was ported from grsecurity/PaX. More information at:
168	   * https://grsecurity.net/
169	   * https://pax.grsecurity.net/
170
171config STACKLEAK_TRACK_MIN_SIZE
172	int "Minimum stack frame size of functions tracked by STACKLEAK"
173	default 100
174	range 0 4096
175	depends on GCC_PLUGIN_STACKLEAK
176	help
177	  The STACKLEAK gcc plugin instruments the kernel code for tracking
178	  the lowest border of the kernel stack (and for some other purposes).
179	  It inserts the stackleak_track_stack() call for the functions with
180	  a stack frame size greater than or equal to this parameter.
181	  If unsure, leave the default value 100.
182
183config STACKLEAK_METRICS
184	bool "Show STACKLEAK metrics in the /proc file system"
185	depends on GCC_PLUGIN_STACKLEAK
186	depends on PROC_FS
187	help
188	  If this is set, STACKLEAK metrics for every task are available in
189	  the /proc file system. In particular, /proc/<pid>/stack_depth
190	  shows the maximum kernel stack consumption for the current and
191	  previous syscalls. Although this information is not precise, it
192	  can be useful for estimating the STACKLEAK performance impact for
193	  your workloads.
194
195config STACKLEAK_RUNTIME_DISABLE
196	bool "Allow runtime disabling of kernel stack erasing"
197	depends on GCC_PLUGIN_STACKLEAK
198	help
199	  This option provides 'stack_erasing' sysctl, which can be used in
200	  runtime to control kernel stack erasing for kernels built with
201	  CONFIG_GCC_PLUGIN_STACKLEAK.
202
203config INIT_ON_ALLOC_DEFAULT_ON
204	bool "Enable heap memory zeroing on allocation by default"
205	help
206	  This has the effect of setting "init_on_alloc=1" on the kernel
207	  command line. This can be disabled with "init_on_alloc=0".
208	  When "init_on_alloc" is enabled, all page allocator and slab
209	  allocator memory will be zeroed when allocated, eliminating
210	  many kinds of "uninitialized heap memory" flaws, especially
211	  heap content exposures. The performance impact varies by
212	  workload, but most cases see <1% impact. Some synthetic
213	  workloads have measured as high as 7%.
214
215config INIT_ON_FREE_DEFAULT_ON
216	bool "Enable heap memory zeroing on free by default"
217	help
218	  This has the effect of setting "init_on_free=1" on the kernel
219	  command line. This can be disabled with "init_on_free=0".
220	  Similar to "init_on_alloc", when "init_on_free" is enabled,
221	  all page allocator and slab allocator memory will be zeroed
222	  when freed, eliminating many kinds of "uninitialized heap memory"
223	  flaws, especially heap content exposures. The primary difference
224	  with "init_on_free" is that data lifetime in memory is reduced,
225	  as anything freed is wiped immediately, making live forensics or
226	  cold boot memory attacks unable to recover freed memory contents.
227	  The performance impact varies by workload, but is more expensive
228	  than "init_on_alloc" due to the negative cache effects of
229	  touching "cold" memory areas. Most cases see 3-5% impact. Some
230	  synthetic workloads have measured as high as 8%.
231
232config CC_HAS_ZERO_CALL_USED_REGS
233	def_bool $(cc-option,-fzero-call-used-regs=used-gpr)
234
235config ZERO_CALL_USED_REGS
236	bool "Enable register zeroing on function exit"
237	depends on CC_HAS_ZERO_CALL_USED_REGS
238	help
239	  At the end of functions, always zero any caller-used register
240	  contents. This helps ensure that temporary values are not
241	  leaked beyond the function boundary. This means that register
242	  contents are less likely to be available for side channels
243	  and information exposures. Additionally, this helps reduce the
244	  number of useful ROP gadgets by about 20% (and removes compiler
245	  generated "write-what-where" gadgets) in the resulting kernel
246	  image. This has a less than 1% performance impact on most
247	  workloads. Image size growth depends on architecture, and should
248	  be evaluated for suitability. For example, x86_64 grows by less
249	  than 1%, and arm64 grows by about 5%.
250
251endmenu
252
253endmenu
254