1# SPDX-License-Identifier: GPL-2.0-only 2menu "Kernel hardening options" 3 4config GCC_PLUGIN_STRUCTLEAK 5 bool 6 help 7 While the kernel is built with warnings enabled for any missed 8 stack variable initializations, this warning is silenced for 9 anything passed by reference to another function, under the 10 occasionally misguided assumption that the function will do 11 the initialization. As this regularly leads to exploitable 12 flaws, this plugin is available to identify and zero-initialize 13 such variables, depending on the chosen level of coverage. 14 15 This plugin was originally ported from grsecurity/PaX. More 16 information at: 17 * https://grsecurity.net/ 18 * https://pax.grsecurity.net/ 19 20menu "Memory initialization" 21 22config CC_HAS_AUTO_VAR_INIT_PATTERN 23 def_bool $(cc-option,-ftrivial-auto-var-init=pattern) 24 25config CC_HAS_AUTO_VAR_INIT_ZERO 26 def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) 27 28choice 29 prompt "Initialize kernel stack variables at function entry" 30 default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS 31 default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN 32 default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN 33 default INIT_STACK_NONE 34 help 35 This option enables initialization of stack variables at 36 function entry time. This has the possibility to have the 37 greatest coverage (since all functions can have their 38 variables initialized), but the performance impact depends 39 on the function calling complexity of a given workload's 40 syscalls. 41 42 This chooses the level of coverage over classes of potentially 43 uninitialized variables. The selected class of variable will be 44 initialized before use in a function. 45 46 config INIT_STACK_NONE 47 bool "no automatic stack variable initialization (weakest)" 48 help 49 Disable automatic stack variable initialization. 50 This leaves the kernel vulnerable to the standard 51 classes of uninitialized stack variable exploits 52 and information exposures. 53 54 config GCC_PLUGIN_STRUCTLEAK_USER 55 bool "zero-init structs marked for userspace (weak)" 56 depends on GCC_PLUGINS 57 select GCC_PLUGIN_STRUCTLEAK 58 help 59 Zero-initialize any structures on the stack containing 60 a __user attribute. This can prevent some classes of 61 uninitialized stack variable exploits and information 62 exposures, like CVE-2013-2141: 63 https://git.kernel.org/linus/b9e146d8eb3b9eca 64 65 config GCC_PLUGIN_STRUCTLEAK_BYREF 66 bool "zero-init structs passed by reference (strong)" 67 depends on GCC_PLUGINS 68 depends on !(KASAN && KASAN_STACK) 69 select GCC_PLUGIN_STRUCTLEAK 70 help 71 Zero-initialize any structures on the stack that may 72 be passed by reference and had not already been 73 explicitly initialized. This can prevent most classes 74 of uninitialized stack variable exploits and information 75 exposures, like CVE-2017-1000410: 76 https://git.kernel.org/linus/06e7e776ca4d3654 77 78 As a side-effect, this keeps a lot of variables on the 79 stack that can otherwise be optimized out, so combining 80 this with CONFIG_KASAN_STACK can lead to a stack overflow 81 and is disallowed. 82 83 config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL 84 bool "zero-init everything passed by reference (very strong)" 85 depends on GCC_PLUGINS 86 depends on !(KASAN && KASAN_STACK) 87 select GCC_PLUGIN_STRUCTLEAK 88 help 89 Zero-initialize any stack variables that may be passed 90 by reference and had not already been explicitly 91 initialized. This is intended to eliminate all classes 92 of uninitialized stack variable exploits and information 93 exposures. 94 95 As a side-effect, this keeps a lot of variables on the 96 stack that can otherwise be optimized out, so combining 97 this with CONFIG_KASAN_STACK can lead to a stack overflow 98 and is disallowed. 99 100 config INIT_STACK_ALL_PATTERN 101 bool "pattern-init everything (strongest)" 102 depends on CC_HAS_AUTO_VAR_INIT_PATTERN 103 help 104 Initializes everything on the stack (including padding) 105 with a specific debug value. This is intended to eliminate 106 all classes of uninitialized stack variable exploits and 107 information exposures, even variables that were warned about 108 having been left uninitialized. 109 110 Pattern initialization is known to provoke many existing bugs 111 related to uninitialized locals, e.g. pointers receive 112 non-NULL values, buffer sizes and indices are very big. The 113 pattern is situation-specific; Clang on 64-bit uses 0xAA 114 repeating for all types and padding except float and double 115 which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF 116 repeating for all types and padding. 117 118 config INIT_STACK_ALL_ZERO 119 bool "zero-init everything (strongest and safest)" 120 depends on CC_HAS_AUTO_VAR_INIT_ZERO 121 help 122 Initializes everything on the stack (including padding) 123 with a zero value. This is intended to eliminate all 124 classes of uninitialized stack variable exploits and 125 information exposures, even variables that were warned 126 about having been left uninitialized. 127 128 Zero initialization provides safe defaults for strings 129 (immediately NUL-terminated), pointers (NULL), indices 130 (index 0), and sizes (0 length), so it is therefore more 131 suitable as a production security mitigation than pattern 132 initialization. 133 134endchoice 135 136config GCC_PLUGIN_STRUCTLEAK_VERBOSE 137 bool "Report forcefully initialized variables" 138 depends on GCC_PLUGIN_STRUCTLEAK 139 depends on !COMPILE_TEST # too noisy 140 help 141 This option will cause a warning to be printed each time the 142 structleak plugin finds a variable it thinks needs to be 143 initialized. Since not all existing initializers are detected 144 by the plugin, this can produce false positive warnings. 145 146config GCC_PLUGIN_STACKLEAK 147 bool "Poison kernel stack before returning from syscalls" 148 depends on GCC_PLUGINS 149 depends on HAVE_ARCH_STACKLEAK 150 help 151 This option makes the kernel erase the kernel stack before 152 returning from system calls. This has the effect of leaving 153 the stack initialized to the poison value, which both reduces 154 the lifetime of any sensitive stack contents and reduces 155 potential for uninitialized stack variable exploits or information 156 exposures (it does not cover functions reaching the same stack 157 depth as prior functions during the same syscall). This blocks 158 most uninitialized stack variable attacks, with the performance 159 impact being driven by the depth of the stack usage, rather than 160 the function calling complexity. 161 162 The performance impact on a single CPU system kernel compilation 163 sees a 1% slowdown, other systems and workloads may vary and you 164 are advised to test this feature on your expected workload before 165 deploying it. 166 167 This plugin was ported from grsecurity/PaX. More information at: 168 * https://grsecurity.net/ 169 * https://pax.grsecurity.net/ 170 171config STACKLEAK_TRACK_MIN_SIZE 172 int "Minimum stack frame size of functions tracked by STACKLEAK" 173 default 100 174 range 0 4096 175 depends on GCC_PLUGIN_STACKLEAK 176 help 177 The STACKLEAK gcc plugin instruments the kernel code for tracking 178 the lowest border of the kernel stack (and for some other purposes). 179 It inserts the stackleak_track_stack() call for the functions with 180 a stack frame size greater than or equal to this parameter. 181 If unsure, leave the default value 100. 182 183config STACKLEAK_METRICS 184 bool "Show STACKLEAK metrics in the /proc file system" 185 depends on GCC_PLUGIN_STACKLEAK 186 depends on PROC_FS 187 help 188 If this is set, STACKLEAK metrics for every task are available in 189 the /proc file system. In particular, /proc/<pid>/stack_depth 190 shows the maximum kernel stack consumption for the current and 191 previous syscalls. Although this information is not precise, it 192 can be useful for estimating the STACKLEAK performance impact for 193 your workloads. 194 195config STACKLEAK_RUNTIME_DISABLE 196 bool "Allow runtime disabling of kernel stack erasing" 197 depends on GCC_PLUGIN_STACKLEAK 198 help 199 This option provides 'stack_erasing' sysctl, which can be used in 200 runtime to control kernel stack erasing for kernels built with 201 CONFIG_GCC_PLUGIN_STACKLEAK. 202 203config INIT_ON_ALLOC_DEFAULT_ON 204 bool "Enable heap memory zeroing on allocation by default" 205 help 206 This has the effect of setting "init_on_alloc=1" on the kernel 207 command line. This can be disabled with "init_on_alloc=0". 208 When "init_on_alloc" is enabled, all page allocator and slab 209 allocator memory will be zeroed when allocated, eliminating 210 many kinds of "uninitialized heap memory" flaws, especially 211 heap content exposures. The performance impact varies by 212 workload, but most cases see <1% impact. Some synthetic 213 workloads have measured as high as 7%. 214 215config INIT_ON_FREE_DEFAULT_ON 216 bool "Enable heap memory zeroing on free by default" 217 help 218 This has the effect of setting "init_on_free=1" on the kernel 219 command line. This can be disabled with "init_on_free=0". 220 Similar to "init_on_alloc", when "init_on_free" is enabled, 221 all page allocator and slab allocator memory will be zeroed 222 when freed, eliminating many kinds of "uninitialized heap memory" 223 flaws, especially heap content exposures. The primary difference 224 with "init_on_free" is that data lifetime in memory is reduced, 225 as anything freed is wiped immediately, making live forensics or 226 cold boot memory attacks unable to recover freed memory contents. 227 The performance impact varies by workload, but is more expensive 228 than "init_on_alloc" due to the negative cache effects of 229 touching "cold" memory areas. Most cases see 3-5% impact. Some 230 synthetic workloads have measured as high as 8%. 231 232config CC_HAS_ZERO_CALL_USED_REGS 233 def_bool $(cc-option,-fzero-call-used-regs=used-gpr) 234 235config ZERO_CALL_USED_REGS 236 bool "Enable register zeroing on function exit" 237 depends on CC_HAS_ZERO_CALL_USED_REGS 238 help 239 At the end of functions, always zero any caller-used register 240 contents. This helps ensure that temporary values are not 241 leaked beyond the function boundary. This means that register 242 contents are less likely to be available for side channels 243 and information exposures. Additionally, this helps reduce the 244 number of useful ROP gadgets by about 20% (and removes compiler 245 generated "write-what-where" gadgets) in the resulting kernel 246 image. This has a less than 1% performance impact on most 247 workloads. Image size growth depends on architecture, and should 248 be evaluated for suitability. For example, x86_64 grows by less 249 than 1%, and arm64 grows by about 5%. 250 251endmenu 252 253endmenu 254
