security/Kconfig.hardening

   1 # SPDX-License-Identifier: GPL-2.0-only
   2 menu "Kernel hardening options"
   3
   4 config GCC_PLUGIN_STRUCTLEAK
   5         bool
   6         help
   7           While the kernel is built with warnings enabled for any missed
   8           stack variable initializations, this warning is silenced for
   9           anything passed by reference to another function, under the
  10           occasionally misguided assumption that the function will do
  11           the initialization. As this regularly leads to exploitable
  12           flaws, this plugin is available to identify and zero-initialize
  13           such variables, depending on the chosen level of coverage.
  14
  15           This plugin was originally ported from grsecurity/PaX. More
  16           information at:
  17            * https://grsecurity.net/
  18            * https://pax.grsecurity.net/
  19
  20 menu "Memory initialization"
  21
  22 config CC_HAS_AUTO_VAR_INIT_PATTERN
  23         def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
  24
  25 config CC_HAS_AUTO_VAR_INIT_ZERO
  26         def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
  27
  28 choice
  29         prompt "Initialize kernel stack variables at function entry"
  30         default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
  31         default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
  32         default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
  33         default INIT_STACK_NONE
  34         help
  35           This option enables initialization of stack variables at
  36           function entry time. This has the possibility to have the
  37           greatest coverage (since all functions can have their
  38           variables initialized), but the performance impact depends
  39           on the function calling complexity of a given workload's
  40           syscalls.
  41
  42           This chooses the level of coverage over classes of potentially
  43           uninitialized variables. The selected class of variable will be
  44           initialized before use in a function.
  45
  46         config INIT_STACK_NONE
  47                 bool "no automatic stack variable initialization (weakest)"
  48                 help
  49                   Disable automatic stack variable initialization.
  50                   This leaves the kernel vulnerable to the standard
  51                   classes of uninitialized stack variable exploits
  52                   and information exposures.
  53
  54         config GCC_PLUGIN_STRUCTLEAK_USER
  55                 bool "zero-init structs marked for userspace (weak)"
  56                 depends on GCC_PLUGINS
  57                 select GCC_PLUGIN_STRUCTLEAK
  58                 help
  59                   Zero-initialize any structures on the stack containing
  60                   a __user attribute. This can prevent some classes of
  61                   uninitialized stack variable exploits and information
  62                   exposures, like CVE-2013-2141:
  63                   https://git.kernel.org/linus/b9e146d8eb3b9eca
  64
  65         config GCC_PLUGIN_STRUCTLEAK_BYREF
  66                 bool "zero-init structs passed by reference (strong)"
  67                 depends on GCC_PLUGINS
  68                 depends on !(KASAN && KASAN_STACK)
  69                 select GCC_PLUGIN_STRUCTLEAK
  70                 help
  71                   Zero-initialize any structures on the stack that may
  72                   be passed by reference and had not already been
  73                   explicitly initialized. This can prevent most classes
  74                   of uninitialized stack variable exploits and information
  75                   exposures, like CVE-2017-1000410:
  76                   https://git.kernel.org/linus/06e7e776ca4d3654
  77
  78                   As a side-effect, this keeps a lot of variables on the
  79                   stack that can otherwise be optimized out, so combining
  80                   this with CONFIG_KASAN_STACK can lead to a stack overflow
  81                   and is disallowed.
  82
  83         config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
  84                 bool "zero-init everything passed by reference (very strong)"
  85                 depends on GCC_PLUGINS
  86                 depends on !(KASAN && KASAN_STACK)
  87                 select GCC_PLUGIN_STRUCTLEAK
  88                 help
  89                   Zero-initialize any stack variables that may be passed
  90                   by reference and had not already been explicitly
  91                   initialized. This is intended to eliminate all classes
  92                   of uninitialized stack variable exploits and information
  93                   exposures.
  94
  95                   As a side-effect, this keeps a lot of variables on the
  96                   stack that can otherwise be optimized out, so combining
  97                   this with CONFIG_KASAN_STACK can lead to a stack overflow
  98                   and is disallowed.
  99
 100         config INIT_STACK_ALL_PATTERN
 101                 bool "pattern-init everything (strongest)"
 102                 depends on CC_HAS_AUTO_VAR_INIT_PATTERN
 103                 help
 104                   Initializes everything on the stack (including padding)
 105                   with a specific debug value. This is intended to eliminate
 106                   all classes of uninitialized stack variable exploits and
 107                   information exposures, even variables that were warned about
 108                   having been left uninitialized.
 109
 110                   Pattern initialization is known to provoke many existing bugs
 111                   related to uninitialized locals, e.g. pointers receive
 112                   non-NULL values, buffer sizes and indices are very big. The
 113                   pattern is situation-specific; Clang on 64-bit uses 0xAA
 114                   repeating for all types and padding except float and double
 115                   which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF
 116                   repeating for all types and padding.
 117
 118         config INIT_STACK_ALL_ZERO
 119                 bool "zero-init everything (strongest and safest)"
 120                 depends on CC_HAS_AUTO_VAR_INIT_ZERO
 121                 help
 122                   Initializes everything on the stack (including padding)
 123                   with a zero value. This is intended to eliminate all
 124                   classes of uninitialized stack variable exploits and
 125                   information exposures, even variables that were warned
 126                   about having been left uninitialized.
 127
 128                   Zero initialization provides safe defaults for strings
 129                   (immediately NUL-terminated), pointers (NULL), indices
 130                   (index 0), and sizes (0 length), so it is therefore more
 131                   suitable as a production security mitigation than pattern
 132                   initialization.
 133
 134 endchoice
 135
 136 config GCC_PLUGIN_STRUCTLEAK_VERBOSE
 137         bool "Report forcefully initialized variables"
 138         depends on GCC_PLUGIN_STRUCTLEAK
 139         depends on !COMPILE_TEST        # too noisy
 140         help
 141           This option will cause a warning to be printed each time the
 142           structleak plugin finds a variable it thinks needs to be
 143           initialized. Since not all existing initializers are detected
 144           by the plugin, this can produce false positive warnings.
 145
 146 config GCC_PLUGIN_STACKLEAK
 147         bool "Poison kernel stack before returning from syscalls"
 148         depends on GCC_PLUGINS
 149         depends on HAVE_ARCH_STACKLEAK
 150         help
 151           This option makes the kernel erase the kernel stack before
 152           returning from system calls. This has the effect of leaving
 153           the stack initialized to the poison value, which both reduces
 154           the lifetime of any sensitive stack contents and reduces
 155           potential for uninitialized stack variable exploits or information
 156           exposures (it does not cover functions reaching the same stack
 157           depth as prior functions during the same syscall). This blocks
 158           most uninitialized stack variable attacks, with the performance
 159           impact being driven by the depth of the stack usage, rather than
 160           the function calling complexity.
 161
 162           The performance impact on a single CPU system kernel compilation
 163           sees a 1% slowdown, other systems and workloads may vary and you
 164           are advised to test this feature on your expected workload before
 165           deploying it.
 166
 167           This plugin was ported from grsecurity/PaX. More information at:
 168            * https://grsecurity.net/
 169            * https://pax.grsecurity.net/
 170
 171 config STACKLEAK_TRACK_MIN_SIZE
 172         int "Minimum stack frame size of functions tracked by STACKLEAK"
 173         default 100
 174         range 0 4096
 175         depends on GCC_PLUGIN_STACKLEAK
 176         help
 177           The STACKLEAK gcc plugin instruments the kernel code for tracking
 178           the lowest border of the kernel stack (and for some other purposes).
 179           It inserts the stackleak_track_stack() call for the functions with
 180           a stack frame size greater than or equal to this parameter.
 181           If unsure, leave the default value 100.
 182
 183 config STACKLEAK_METRICS
 184         bool "Show STACKLEAK metrics in the /proc file system"
 185         depends on GCC_PLUGIN_STACKLEAK
 186         depends on PROC_FS
 187         help
 188           If this is set, STACKLEAK metrics for every task are available in
 189           the /proc file system. In particular, /proc/<pid>/stack_depth
 190           shows the maximum kernel stack consumption for the current and
 191           previous syscalls. Although this information is not precise, it
 192           can be useful for estimating the STACKLEAK performance impact for
 193           your workloads.
 194
 195 config STACKLEAK_RUNTIME_DISABLE
 196         bool "Allow runtime disabling of kernel stack erasing"
 197         depends on GCC_PLUGIN_STACKLEAK
 198         help
 199           This option provides 'stack_erasing' sysctl, which can be used in
 200           runtime to control kernel stack erasing for kernels built with
 201           CONFIG_GCC_PLUGIN_STACKLEAK.
 202
 203 config INIT_ON_ALLOC_DEFAULT_ON
 204         bool "Enable heap memory zeroing on allocation by default"
 205         help
 206           This has the effect of setting "init_on_alloc=1" on the kernel
 207           command line. This can be disabled with "init_on_alloc=0".
 208           When "init_on_alloc" is enabled, all page allocator and slab
 209           allocator memory will be zeroed when allocated, eliminating
 210           many kinds of "uninitialized heap memory" flaws, especially
 211           heap content exposures. The performance impact varies by
 212           workload, but most cases see <1% impact. Some synthetic
 213           workloads have measured as high as 7%.
 214
 215 config INIT_ON_FREE_DEFAULT_ON
 216         bool "Enable heap memory zeroing on free by default"
 217         help
 218           This has the effect of setting "init_on_free=1" on the kernel
 219           command line. This can be disabled with "init_on_free=0".
 220           Similar to "init_on_alloc", when "init_on_free" is enabled,
 221           all page allocator and slab allocator memory will be zeroed
 222           when freed, eliminating many kinds of "uninitialized heap memory"
 223           flaws, especially heap content exposures. The primary difference
 224           with "init_on_free" is that data lifetime in memory is reduced,
 225           as anything freed is wiped immediately, making live forensics or
 226           cold boot memory attacks unable to recover freed memory contents.
 227           The performance impact varies by workload, but is more expensive
 228           than "init_on_alloc" due to the negative cache effects of
 229           touching "cold" memory areas. Most cases see 3-5% impact. Some
 230           synthetic workloads have measured as high as 8%.
 231
 232 config CC_HAS_ZERO_CALL_USED_REGS
 233         def_bool $(cc-option,-fzero-call-used-regs=used-gpr)
 234
 235 config ZERO_CALL_USED_REGS
 236         bool "Enable register zeroing on function exit"
 237         depends on CC_HAS_ZERO_CALL_USED_REGS
 238         help
 239           At the end of functions, always zero any caller-used register
 240           contents. This helps ensure that temporary values are not
 241           leaked beyond the function boundary. This means that register
 242           contents are less likely to be available for side channels
 243           and information exposures. Additionally, this helps reduce the
 244           number of useful ROP gadgets by about 20% (and removes compiler
 245           generated "write-what-where" gadgets) in the resulting kernel
 246           image. This has a less than 1% performance impact on most
 247           workloads. Image size growth depends on architecture, and should
 248           be evaluated for suitability. For example, x86_64 grows by less
 249           than 1%, and arm64 grows by about 5%.
 250
 251 endmenu
 252
 253 endmenu