| xj | b04a402 | 2021-11-25 15:01:52 +0800 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | menu "Kernel hardening options" |
| 3 | |
| 4 | config GCC_PLUGIN_STRUCTLEAK |
| 5 | bool |
| 6 | help |
| 7 | While the kernel is built with warnings enabled for any missed |
| 8 | stack variable initializations, this warning is silenced for |
| 9 | anything passed by reference to another function, under the |
| 10 | occasionally misguided assumption that the function will do |
| 11 | the initialization. As this regularly leads to exploitable |
| 12 | flaws, this plugin is available to identify and zero-initialize |
| 13 | such variables, depending on the chosen level of coverage. |
| 14 | |
| 15 | This plugin was originally ported from grsecurity/PaX. More |
| 16 | information at: |
| 17 | * https://grsecurity.net/ |
| 18 | * https://pax.grsecurity.net/ |
| 19 | |
| 20 | menu "Memory initialization" |
| 21 | |
| 22 | config CC_HAS_AUTO_VAR_INIT |
| 23 | def_bool $(cc-option,-ftrivial-auto-var-init=pattern) |
| 24 | |
| 25 | choice |
| 26 | prompt "Initialize kernel stack variables at function entry" |
| 27 | default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS |
| 28 | default INIT_STACK_ALL if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT |
| 29 | default INIT_STACK_NONE |
| 30 | help |
| 31 | This option enables initialization of stack variables at |
| 32 | function entry time. This has the possibility to have the |
| 33 | greatest coverage (since all functions can have their |
| 34 | variables initialized), but the performance impact depends |
| 35 | on the function calling complexity of a given workload's |
| 36 | syscalls. |
| 37 | |
| 38 | This chooses the level of coverage over classes of potentially |
| 39 | uninitialized variables. The selected class will be |
| 40 | initialized before use in a function. |
| 41 | |
| 42 | config INIT_STACK_NONE |
| 43 | bool "no automatic initialization (weakest)" |
| 44 | help |
| 45 | Disable automatic stack variable initialization. |
| 46 | This leaves the kernel vulnerable to the standard |
| 47 | classes of uninitialized stack variable exploits |
| 48 | and information exposures. |
| 49 | |
| 50 | config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL |
| 51 | bool "zero-init anything passed by reference (very strong)" |
| 52 | depends on GCC_PLUGINS |
| 53 | select GCC_PLUGIN_STRUCTLEAK |
| 54 | help |
| 55 | Zero-initialize any stack variables that may be passed |
| 56 | by reference and had not already been explicitly |
| 57 | initialized. This is intended to eliminate all classes |
| 58 | of uninitialized stack variable exploits and information |
| 59 | exposures. |
| 60 | |
| 61 | config INIT_STACK_ALL |
| 62 | bool "0xAA-init everything on the stack (strongest)" |
| 63 | depends on CC_HAS_AUTO_VAR_INIT |
| 64 | help |
| 65 | Initializes everything on the stack with a 0xAA |
| 66 | pattern. This is intended to eliminate all classes |
| 67 | of uninitialized stack variable exploits and information |
| 68 | exposures, even variables that were warned to have been |
| 69 | left uninitialized. |
| 70 | |
| 71 | endchoice |
| 72 | |
| 73 | config GCC_PLUGIN_STRUCTLEAK_VERBOSE |
| 74 | bool "Report forcefully initialized variables" |
| 75 | depends on GCC_PLUGIN_STRUCTLEAK |
| 76 | depends on !COMPILE_TEST # too noisy |
| 77 | help |
| 78 | This option will cause a warning to be printed each time the |
| 79 | structleak plugin finds a variable it thinks needs to be |
| 80 | initialized. Since not all existing initializers are detected |
| 81 | by the plugin, this can produce false positive warnings. |
| 82 | |
| 83 | config INIT_ON_ALLOC_DEFAULT_ON |
| 84 | bool "Enable heap memory zeroing on allocation by default" |
| 85 | help |
| 86 | This has the effect of setting "init_on_alloc=1" on the kernel |
| 87 | command line. This can be disabled with "init_on_alloc=0". |
| 88 | When "init_on_alloc" is enabled, all page allocator and slab |
| 89 | allocator memory will be zeroed when allocated, eliminating |
| 90 | many kinds of "uninitialized heap memory" flaws, especially |
| 91 | heap content exposures. The performance impact varies by |
| 92 | workload, but most cases see <1% impact. Some synthetic |
| 93 | workloads have measured as high as 7%. |
| 94 | |
| 95 | config INIT_ON_FREE_DEFAULT_ON |
| 96 | bool "Enable heap memory zeroing on free by default" |
| 97 | help |
| 98 | This has the effect of setting "init_on_free=1" on the kernel |
| 99 | command line. This can be disabled with "init_on_free=0". |
| 100 | Similar to "init_on_alloc", when "init_on_free" is enabled, |
| 101 | all page allocator and slab allocator memory will be zeroed |
| 102 | when freed, eliminating many kinds of "uninitialized heap memory" |
| 103 | flaws, especially heap content exposures. The primary difference |
| 104 | with "init_on_free" is that data lifetime in memory is reduced, |
| 105 | as anything freed is wiped immediately, making live forensics or |
| 106 | cold boot memory attacks unable to recover freed memory contents. |
| 107 | The performance impact varies by workload, but is more expensive |
| 108 | than "init_on_alloc" due to the negative cache effects of |
| 109 | touching "cold" memory areas. Most cases see 3-5% impact. Some |
| 110 | synthetic workloads have measured as high as 8%. |
| 111 | |
| 112 | endmenu |
| 113 | |
| 114 | endmenu |