Skip to contentSkip to conversation

hardening: Provide Kconfig fragments for basic options

PATCH In review Kees Cook 2 participants 2 messages Aug 25, 2023 – Sep 2, 2023

Subsystems (6)
Documentation Arm (32-bit) x86 Kbuild +2 more subsystems
lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 hardening: Provide Kconfig fragments for basic options

Inspired by Salvatore Mesoraca's earlier[1] efforts to provide some in-tree guidance for kernel hardening Kconfig options, add a new fragment named "hardening-basic.config" (along with some arch-specific fragments) that enable a basic set of kernel hardening options that have the least (or no) performance impact and remove a reasonable set of legacy APIs.

Using this fragment is as simple as running "make hardening.config".

More extreme fragments can be added[2] in the future to cover all the recognized hardening options, and more per-architecture files can be added too.

For now, document the fragments directly via comments. Perhaps .rst documentation can be generated from them in the future (rather than the other way around).

[1] https://lore.kernel.org/kernel-hardening/[email protected]/
[2] https://github.com/KSPP/linux/issues/14

Cc Salvatore Mesoraca <[email protected]>
Cc [email protected]
Cc [email protected]
Cc [email protected]
Cc [email protected]
Signed-off-by Kees Cook <[email protected]>
---
 MAINTAINERS                         |  2 +
 arch/arm/configs/hardening.config   |  7 ++
 arch/arm64/configs/hardening.config | 22 +++++++
 arch/x86/configs/hardening.config   | 15 +++++
 kernel/configs/hardening.config     | 99 +++++++++++++++++++++++++++++
 5 files changed, 145 insertions(+)
 create mode 100644 arch/arm/configs/hardening.config
 create mode 100644 arch/arm64/configs/hardening.config
 create mode 100644 arch/x86/configs/hardening.config
 create mode 100644 kernel/configs/hardening.config
MAINTAINERS +2 -0
index 48abe1a281f2..36a28c132133 100644
@@ -11304,8 +11304,10 @@ S:	Supported
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
 F:	Documentation/ABI/testing/sysfs-kernel-oops_count
 F:	Documentation/ABI/testing/sysfs-kernel-warn_count
+F:	arch/*/configs/hardening.config
 F:	include/linux/overflow.h
 F:	include/linux/randomize_kstack.h
+F:	kernel/configs/hardening.config
 F:	mm/usercopy.c
 K:	\b(add|choose)_random_kstack_offset\b
 K:	\b__check_(object_size|heap_object)\b
arch/arm/configs/hardening.config new file +7 -0
new file mode 100644
index 000000000000..327349ce6377
@@ -0,0 +1,7 @@
+# Basic kernel hardening options (specific to arm)
+
+# Make sure PXN/PAN emulation is enabled.
+CONFIG_CPU_SW_DOMAIN_PAN=y
+
+# Dangerous; old interfaces and needless additional attack surface.
+# CONFIG_OABI_COMPAT is not set
arch/arm64/configs/hardening.config new file +22 -0
new file mode 100644
index 000000000000..b0e795208998
@@ -0,0 +1,22 @@
+# Basic kernel hardening options (specific to arm64)
+
+# Make sure PAN emulation is enabled.
+CONFIG_ARM64_SW_TTBR0_PAN=y
+
+# Software Shadow Stack or PAC
+CONFIG_SHADOW_CALL_STACK=y
+
+# Pointer authentication (ARMv8.3 and later). If hardware actually supports
+# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+
+# Available in ARMv8.5 and later.
+CONFIG_ARM64_BTI=y
+CONFIG_ARM64_BTI_KERNEL=y
+CONFIG_ARM64_MTE=y
+CONFIG_KASAN_HW_TAGS=y
+CONFIG_ARM64_E0PD=y
+
+# Available in ARMv8.7 and later.
+CONFIG_ARM64_EPAN=y
arch/x86/configs/hardening.config new file +15 -0
new file mode 100644
index 000000000000..19bb0c7a7669
@@ -0,0 +1,15 @@
+# Basic kernel hardening options (specific to x86)
+
+# Modern libc no longer needs a fixed-position mapping in userspace, remove
+# it as a possible target.
+CONFIG_LEGACY_VSYSCALL_NONE=y
+
+# Enable chip-specific IOMMU support.
+CONFIG_INTEL_IOMMU=y
+CONFIG_INTEL_IOMMU_DEFAULT_ON=y
+CONFIG_INTEL_IOMMU_SVM=y
+CONFIG_AMD_IOMMU=y
+CONFIG_AMD_IOMMU_V2=y
+
+# Enable CET Shadow Stack for userspace.
+CONFIG_X86_USER_SHADOW_STACK=y
kernel/configs/hardening.config new file +99 -0

99 lines not on this page · raw message

Signature · 7 lines
2.34.1


_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
#1 lore raw
Quoted 8 lines · Kees Cook

Inspired by Salvatore Mesoraca's earlier[1] efforts to provide some in-tree guidance for kernel hardening Kconfig options, add a new fragment named "hardening-basic.config" (along with some arch-specific fragments) that enable a basic set of kernel hardening options that have the least (or no) performance impact and remove a reasonable set of legacy APIs.

Using this fragment is as simple as running "make hardening.config".

Quoted 8 lines

More extreme fragments can be added[2] in the future to cover all the recognized hardening options, and more per-architecture files can be added too.

For now, document the fragments directly via comments. Perhaps .rst documentation can be generated from them in the future (rather than the other way around).

This is likely to make life a bit easier for us downstream in Gentoo, where we currently supply a patch for KSPP:
https://gitweb.gentoo.org/proj/linux-patches.git/tree/4567_distro-Gentoo-Kconfig.patch?h=6.4#n237.

Quoted 2 lines

[1] https://lore.kernel.org/kernel-hardening/[email protected]/
[2] https://github.com/KSPP/linux/issues/14

best,
sam