1# SPDX-License-Identifier: GPL-2.0-only 2menu "Kernel hardening options" 3 4config GCC_PLUGIN_STRUCTLEAK 5 bool 6 help 7 While the kernel is built with warnings enabled for any missed 8 stack variable initializations, this warning is silenced for 9 anything passed by reference to another function, under the 10 occasionally misguided assumption that the function will do 11 the initialization. As this regularly leads to exploitable 12 flaws, this plugin is available to identify and zero-initialize 13 such variables, depending on the chosen level of coverage. 14 15 This plugin was originally ported from grsecurity/PaX. More 16 information at: 17 * https://grsecurity.net/ 18 * https://pax.grsecurity.net/ 19 20menu "Memory initialization" 21 22config CC_HAS_AUTO_VAR_INIT_PATTERN 23 def_bool $(cc-option,-ftrivial-auto-var-init=pattern) 24 25config CC_HAS_AUTO_VAR_INIT_ZERO 26 def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) 27 28choice 29 prompt "Initialize kernel stack variables at function entry" 30 default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS 31 default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN 32 default INIT_STACK_NONE 33 help 34 This option enables initialization of stack variables at 35 function entry time. This has the possibility to have the 36 greatest coverage (since all functions can have their 37 variables initialized), but the performance impact depends 38 on the function calling complexity of a given workload's 39 syscalls. 40 41 This chooses the level of coverage over classes of potentially 42 uninitialized variables. The selected class will be 43 initialized before use in a function. 44 45 config INIT_STACK_NONE 46 bool "no automatic initialization (weakest)" 47 help 48 Disable automatic stack variable initialization. 49 This leaves the kernel vulnerable to the standard 50 classes of uninitialized stack variable exploits 51 and information exposures. 52 53 config GCC_PLUGIN_STRUCTLEAK_USER 54 bool "zero-init structs marked for userspace (weak)" 55 depends on GCC_PLUGINS 56 select GCC_PLUGIN_STRUCTLEAK 57 help 58 Zero-initialize any structures on the stack containing 59 a __user attribute. This can prevent some classes of 60 uninitialized stack variable exploits and information 61 exposures, like CVE-2013-2141: 62 https://git.kernel.org/linus/b9e146d8eb3b9eca 63 64 config GCC_PLUGIN_STRUCTLEAK_BYREF 65 bool "zero-init structs passed by reference (strong)" 66 depends on GCC_PLUGINS 67 depends on !(KASAN && KASAN_STACK) 68 select GCC_PLUGIN_STRUCTLEAK 69 help 70 Zero-initialize any structures on the stack that may 71 be passed by reference and had not already been 72 explicitly initialized. This can prevent most classes 73 of uninitialized stack variable exploits and information 74 exposures, like CVE-2017-1000410: 75 https://git.kernel.org/linus/06e7e776ca4d3654 76 77 As a side-effect, this keeps a lot of variables on the 78 stack that can otherwise be optimized out, so combining 79 this with CONFIG_KASAN_STACK can lead to a stack overflow 80 and is disallowed. 81 82 config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL 83 bool "zero-init anything passed by reference (very strong)" 84 depends on GCC_PLUGINS 85 depends on !(KASAN && KASAN_STACK) 86 select GCC_PLUGIN_STRUCTLEAK 87 help 88 Zero-initialize any stack variables that may be passed 89 by reference and had not already been explicitly 90 initialized. This is intended to eliminate all classes 91 of uninitialized stack variable exploits and information 92 exposures. 93 94 config INIT_STACK_ALL_PATTERN 95 bool "0xAA-init everything on the stack (strongest)" 96 depends on CC_HAS_AUTO_VAR_INIT_PATTERN 97 help 98 Initializes everything on the stack with a 0xAA 99 pattern. This is intended to eliminate all classes 100 of uninitialized stack variable exploits and information 101 exposures, even variables that were warned to have been 102 left uninitialized. 103 104 Pattern initialization is known to provoke many existing bugs 105 related to uninitialized locals, e.g. pointers receive 106 non-NULL values, buffer sizes and indices are very big. 107 108 config INIT_STACK_ALL_ZERO 109 bool "zero-init everything on the stack (strongest and safest)" 110 depends on CC_HAS_AUTO_VAR_INIT_ZERO 111 help 112 Initializes everything on the stack with a zero 113 value. This is intended to eliminate all classes 114 of uninitialized stack variable exploits and information 115 exposures, even variables that were warned to have been 116 left uninitialized. 117 118 Zero initialization provides safe defaults for strings, 119 pointers, indices and sizes, and is therefore 120 more suitable as a security mitigation measure. 121 122endchoice 123 124config GCC_PLUGIN_STRUCTLEAK_VERBOSE 125 bool "Report forcefully initialized variables" 126 depends on GCC_PLUGIN_STRUCTLEAK 127 depends on !COMPILE_TEST # too noisy 128 help 129 This option will cause a warning to be printed each time the 130 structleak plugin finds a variable it thinks needs to be 131 initialized. Since not all existing initializers are detected 132 by the plugin, this can produce false positive warnings. 133 134config GCC_PLUGIN_STACKLEAK 135 bool "Poison kernel stack before returning from syscalls" 136 depends on GCC_PLUGINS 137 depends on HAVE_ARCH_STACKLEAK 138 help 139 This option makes the kernel erase the kernel stack before 140 returning from system calls. This has the effect of leaving 141 the stack initialized to the poison value, which both reduces 142 the lifetime of any sensitive stack contents and reduces 143 potential for uninitialized stack variable exploits or information 144 exposures (it does not cover functions reaching the same stack 145 depth as prior functions during the same syscall). This blocks 146 most uninitialized stack variable attacks, with the performance 147 impact being driven by the depth of the stack usage, rather than 148 the function calling complexity. 149 150 The performance impact on a single CPU system kernel compilation 151 sees a 1% slowdown, other systems and workloads may vary and you 152 are advised to test this feature on your expected workload before 153 deploying it. 154 155 This plugin was ported from grsecurity/PaX. More information at: 156 * https://grsecurity.net/ 157 * https://pax.grsecurity.net/ 158 159config STACKLEAK_TRACK_MIN_SIZE 160 int "Minimum stack frame size of functions tracked by STACKLEAK" 161 default 100 162 range 0 4096 163 depends on GCC_PLUGIN_STACKLEAK 164 help 165 The STACKLEAK gcc plugin instruments the kernel code for tracking 166 the lowest border of the kernel stack (and for some other purposes). 167 It inserts the stackleak_track_stack() call for the functions with 168 a stack frame size greater than or equal to this parameter. 169 If unsure, leave the default value 100. 170 171config STACKLEAK_METRICS 172 bool "Show STACKLEAK metrics in the /proc file system" 173 depends on GCC_PLUGIN_STACKLEAK 174 depends on PROC_FS 175 help 176 If this is set, STACKLEAK metrics for every task are available in 177 the /proc file system. In particular, /proc/<pid>/stack_depth 178 shows the maximum kernel stack consumption for the current and 179 previous syscalls. Although this information is not precise, it 180 can be useful for estimating the STACKLEAK performance impact for 181 your workloads. 182 183config STACKLEAK_RUNTIME_DISABLE 184 bool "Allow runtime disabling of kernel stack erasing" 185 depends on GCC_PLUGIN_STACKLEAK 186 help 187 This option provides 'stack_erasing' sysctl, which can be used in 188 runtime to control kernel stack erasing for kernels built with 189 CONFIG_GCC_PLUGIN_STACKLEAK. 190 191config INIT_ON_ALLOC_DEFAULT_ON 192 bool "Enable heap memory zeroing on allocation by default" 193 help 194 This has the effect of setting "init_on_alloc=1" on the kernel 195 command line. This can be disabled with "init_on_alloc=0". 196 When "init_on_alloc" is enabled, all page allocator and slab 197 allocator memory will be zeroed when allocated, eliminating 198 many kinds of "uninitialized heap memory" flaws, especially 199 heap content exposures. The performance impact varies by 200 workload, but most cases see <1% impact. Some synthetic 201 workloads have measured as high as 7%. 202 203config INIT_ON_FREE_DEFAULT_ON 204 bool "Enable heap memory zeroing on free by default" 205 help 206 This has the effect of setting "init_on_free=1" on the kernel 207 command line. This can be disabled with "init_on_free=0". 208 Similar to "init_on_alloc", when "init_on_free" is enabled, 209 all page allocator and slab allocator memory will be zeroed 210 when freed, eliminating many kinds of "uninitialized heap memory" 211 flaws, especially heap content exposures. The primary difference 212 with "init_on_free" is that data lifetime in memory is reduced, 213 as anything freed is wiped immediately, making live forensics or 214 cold boot memory attacks unable to recover freed memory contents. 215 The performance impact varies by workload, but is more expensive 216 than "init_on_alloc" due to the negative cache effects of 217 touching "cold" memory areas. Most cases see 3-5% impact. Some 218 synthetic workloads have measured as high as 8%. 219 220endmenu 221 222endmenu 223