xref: /linux/security/Kconfig.hardening (revision 5ab889facc6893e4a973d6ab5432550ef4f6ff09)
1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only
29f671e58SKees Cookmenu "Kernel hardening options"
39f671e58SKees Cook
49f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK
59f671e58SKees Cook	bool
69f671e58SKees Cook	help
79f671e58SKees Cook	  While the kernel is built with warnings enabled for any missed
89f671e58SKees Cook	  stack variable initializations, this warning is silenced for
99f671e58SKees Cook	  anything passed by reference to another function, under the
109f671e58SKees Cook	  occasionally misguided assumption that the function will do
119f671e58SKees Cook	  the initialization. As this regularly leads to exploitable
129f671e58SKees Cook	  flaws, this plugin is available to identify and zero-initialize
139f671e58SKees Cook	  such variables, depending on the chosen level of coverage.
149f671e58SKees Cook
159f671e58SKees Cook	  This plugin was originally ported from grsecurity/PaX. More
169f671e58SKees Cook	  information at:
179f671e58SKees Cook	   * https://grsecurity.net/
189f671e58SKees Cook	   * https://pax.grsecurity.net/
199f671e58SKees Cook
209f671e58SKees Cookmenu "Memory initialization"
219f671e58SKees Cook
22f0fe00d4Sglider@google.comconfig CC_HAS_AUTO_VAR_INIT_PATTERN
23709a972eSKees Cook	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
24709a972eSKees Cook
25607e57c6SKees Cookconfig CC_HAS_AUTO_VAR_INIT_ZERO_BARE
26607e57c6SKees Cook	def_bool $(cc-option,-ftrivial-auto-var-init=zero)
27607e57c6SKees Cook
28607e57c6SKees Cookconfig CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
29607e57c6SKees Cook	# Clang 16 and later warn about using the -enable flag, but it
30607e57c6SKees Cook	# is required before then.
31f0fe00d4Sglider@google.com	def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
32607e57c6SKees Cook	depends on !CC_HAS_AUTO_VAR_INIT_ZERO_BARE
33607e57c6SKees Cook
34607e57c6SKees Cookconfig CC_HAS_AUTO_VAR_INIT_ZERO
35607e57c6SKees Cook	def_bool CC_HAS_AUTO_VAR_INIT_ZERO_BARE || CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
36f0fe00d4Sglider@google.com
379f671e58SKees Cookchoice
389f671e58SKees Cook	prompt "Initialize kernel stack variables at function entry"
399f671e58SKees Cook	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
40f0fe00d4Sglider@google.com	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
41f02003c8SKees Cook	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
429f671e58SKees Cook	default INIT_STACK_NONE
439f671e58SKees Cook	help
449f671e58SKees Cook	  This option enables initialization of stack variables at
459f671e58SKees Cook	  function entry time. This has the possibility to have the
469f671e58SKees Cook	  greatest coverage (since all functions can have their
479f671e58SKees Cook	  variables initialized), but the performance impact depends
489f671e58SKees Cook	  on the function calling complexity of a given workload's
499f671e58SKees Cook	  syscalls.
509f671e58SKees Cook
519f671e58SKees Cook	  This chooses the level of coverage over classes of potentially
52dcb7c0b9SKees Cook	  uninitialized variables. The selected class of variable will be
539f671e58SKees Cook	  initialized before use in a function.
549f671e58SKees Cook
559f671e58SKees Cook	config INIT_STACK_NONE
56dcb7c0b9SKees Cook		bool "no automatic stack variable initialization (weakest)"
579f671e58SKees Cook		help
589f671e58SKees Cook		  Disable automatic stack variable initialization.
599f671e58SKees Cook		  This leaves the kernel vulnerable to the standard
609f671e58SKees Cook		  classes of uninitialized stack variable exploits
619f671e58SKees Cook		  and information exposures.
629f671e58SKees Cook
639f671e58SKees Cook	config GCC_PLUGIN_STRUCTLEAK_USER
649f671e58SKees Cook		bool "zero-init structs marked for userspace (weak)"
658bd51a2bSKees Cook		# Plugin can be removed once the kernel only supports GCC 12+
668bd51a2bSKees Cook		depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO
679f671e58SKees Cook		select GCC_PLUGIN_STRUCTLEAK
689f671e58SKees Cook		help
699f671e58SKees Cook		  Zero-initialize any structures on the stack containing
709f671e58SKees Cook		  a __user attribute. This can prevent some classes of
719f671e58SKees Cook		  uninitialized stack variable exploits and information
729f671e58SKees Cook		  exposures, like CVE-2013-2141:
739f671e58SKees Cook		  https://git.kernel.org/linus/b9e146d8eb3b9eca
749f671e58SKees Cook
759f671e58SKees Cook	config GCC_PLUGIN_STRUCTLEAK_BYREF
769f671e58SKees Cook		bool "zero-init structs passed by reference (strong)"
778bd51a2bSKees Cook		# Plugin can be removed once the kernel only supports GCC 12+
788bd51a2bSKees Cook		depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO
7902c58773SWalter Wu		depends on !(KASAN && KASAN_STACK)
809f671e58SKees Cook		select GCC_PLUGIN_STRUCTLEAK
819f671e58SKees Cook		help
829f671e58SKees Cook		  Zero-initialize any structures on the stack that may
839f671e58SKees Cook		  be passed by reference and had not already been
849f671e58SKees Cook		  explicitly initialized. This can prevent most classes
859f671e58SKees Cook		  of uninitialized stack variable exploits and information
869f671e58SKees Cook		  exposures, like CVE-2017-1000410:
879f671e58SKees Cook		  https://git.kernel.org/linus/06e7e776ca4d3654
889f671e58SKees Cook
89173e6ee2SArnd Bergmann		  As a side-effect, this keeps a lot of variables on the
90173e6ee2SArnd Bergmann		  stack that can otherwise be optimized out, so combining
91173e6ee2SArnd Bergmann		  this with CONFIG_KASAN_STACK can lead to a stack overflow
92173e6ee2SArnd Bergmann		  and is disallowed.
93173e6ee2SArnd Bergmann
949f671e58SKees Cook	config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
95dcb7c0b9SKees Cook		bool "zero-init everything passed by reference (very strong)"
968bd51a2bSKees Cook		# Plugin can be removed once the kernel only supports GCC 12+
978bd51a2bSKees Cook		depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO
9802c58773SWalter Wu		depends on !(KASAN && KASAN_STACK)
999f671e58SKees Cook		select GCC_PLUGIN_STRUCTLEAK
1009f671e58SKees Cook		help
1019f671e58SKees Cook		  Zero-initialize any stack variables that may be passed
1029f671e58SKees Cook		  by reference and had not already been explicitly
1039f671e58SKees Cook		  initialized. This is intended to eliminate all classes
1049f671e58SKees Cook		  of uninitialized stack variable exploits and information
1059f671e58SKees Cook		  exposures.
1069f671e58SKees Cook
107dcb7c0b9SKees Cook		  As a side-effect, this keeps a lot of variables on the
108dcb7c0b9SKees Cook		  stack that can otherwise be optimized out, so combining
109dcb7c0b9SKees Cook		  this with CONFIG_KASAN_STACK can lead to a stack overflow
110dcb7c0b9SKees Cook		  and is disallowed.
111dcb7c0b9SKees Cook
112f0fe00d4Sglider@google.com	config INIT_STACK_ALL_PATTERN
113dcb7c0b9SKees Cook		bool "pattern-init everything (strongest)"
114f0fe00d4Sglider@google.com		depends on CC_HAS_AUTO_VAR_INIT_PATTERN
11542eaa27dSAlexander Potapenko		depends on !KMSAN
116709a972eSKees Cook		help
117dcb7c0b9SKees Cook		  Initializes everything on the stack (including padding)
118dcb7c0b9SKees Cook		  with a specific debug value. This is intended to eliminate
119dcb7c0b9SKees Cook		  all classes of uninitialized stack variable exploits and
120dcb7c0b9SKees Cook		  information exposures, even variables that were warned about
121dcb7c0b9SKees Cook		  having been left uninitialized.
122709a972eSKees Cook
123f0fe00d4Sglider@google.com		  Pattern initialization is known to provoke many existing bugs
124f0fe00d4Sglider@google.com		  related to uninitialized locals, e.g. pointers receive
125dcb7c0b9SKees Cook		  non-NULL values, buffer sizes and indices are very big. The
126dcb7c0b9SKees Cook		  pattern is situation-specific; Clang on 64-bit uses 0xAA
127dcb7c0b9SKees Cook		  repeating for all types and padding except float and double
128dcb7c0b9SKees Cook		  which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF
129dcb7c0b9SKees Cook		  repeating for all types and padding.
130*a9a5e0bdSGeert Uytterhoeven		  GCC uses 0xFE repeating for all types, and zero for padding.
131f0fe00d4Sglider@google.com
132f0fe00d4Sglider@google.com	config INIT_STACK_ALL_ZERO
133dcb7c0b9SKees Cook		bool "zero-init everything (strongest and safest)"
134f0fe00d4Sglider@google.com		depends on CC_HAS_AUTO_VAR_INIT_ZERO
13542eaa27dSAlexander Potapenko		depends on !KMSAN
136f0fe00d4Sglider@google.com		help
137dcb7c0b9SKees Cook		  Initializes everything on the stack (including padding)
138dcb7c0b9SKees Cook		  with a zero value. This is intended to eliminate all
139dcb7c0b9SKees Cook		  classes of uninitialized stack variable exploits and
140dcb7c0b9SKees Cook		  information exposures, even variables that were warned
141dcb7c0b9SKees Cook		  about having been left uninitialized.
142f0fe00d4Sglider@google.com
143dcb7c0b9SKees Cook		  Zero initialization provides safe defaults for strings
144dcb7c0b9SKees Cook		  (immediately NUL-terminated), pointers (NULL), indices
145dcb7c0b9SKees Cook		  (index 0), and sizes (0 length), so it is therefore more
146dcb7c0b9SKees Cook		  suitable as a production security mitigation than pattern
147dcb7c0b9SKees Cook		  initialization.
148f0fe00d4Sglider@google.com
1499f671e58SKees Cookendchoice
1509f671e58SKees Cook
1519f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK_VERBOSE
1529f671e58SKees Cook	bool "Report forcefully initialized variables"
1539f671e58SKees Cook	depends on GCC_PLUGIN_STRUCTLEAK
1549f671e58SKees Cook	depends on !COMPILE_TEST	# too noisy
1559f671e58SKees Cook	help
1569f671e58SKees Cook	  This option will cause a warning to be printed each time the
1579f671e58SKees Cook	  structleak plugin finds a variable it thinks needs to be
1589f671e58SKees Cook	  initialized. Since not all existing initializers are detected
1599f671e58SKees Cook	  by the plugin, this can produce false positive warnings.
1609f671e58SKees Cook
161b6a6a377SKees Cookconfig GCC_PLUGIN_STACKLEAK
162b6a6a377SKees Cook	bool "Poison kernel stack before returning from syscalls"
163b6a6a377SKees Cook	depends on GCC_PLUGINS
164b6a6a377SKees Cook	depends on HAVE_ARCH_STACKLEAK
165b6a6a377SKees Cook	help
166b6a6a377SKees Cook	  This option makes the kernel erase the kernel stack before
167b6a6a377SKees Cook	  returning from system calls. This has the effect of leaving
168b6a6a377SKees Cook	  the stack initialized to the poison value, which both reduces
169b6a6a377SKees Cook	  the lifetime of any sensitive stack contents and reduces
170b6a6a377SKees Cook	  potential for uninitialized stack variable exploits or information
171b6a6a377SKees Cook	  exposures (it does not cover functions reaching the same stack
172b6a6a377SKees Cook	  depth as prior functions during the same syscall). This blocks
173b6a6a377SKees Cook	  most uninitialized stack variable attacks, with the performance
174b6a6a377SKees Cook	  impact being driven by the depth of the stack usage, rather than
175b6a6a377SKees Cook	  the function calling complexity.
176b6a6a377SKees Cook
177b6a6a377SKees Cook	  The performance impact on a single CPU system kernel compilation
178b6a6a377SKees Cook	  sees a 1% slowdown, other systems and workloads may vary and you
179b6a6a377SKees Cook	  are advised to test this feature on your expected workload before
180b6a6a377SKees Cook	  deploying it.
181b6a6a377SKees Cook
182b6a6a377SKees Cook	  This plugin was ported from grsecurity/PaX. More information at:
183b6a6a377SKees Cook	   * https://grsecurity.net/
184b6a6a377SKees Cook	   * https://pax.grsecurity.net/
185b6a6a377SKees Cook
186f154066bSKees Cookconfig GCC_PLUGIN_STACKLEAK_VERBOSE
187f154066bSKees Cook	bool "Report stack depth analysis instrumentation" if EXPERT
188f154066bSKees Cook	depends on GCC_PLUGIN_STACKLEAK
189f154066bSKees Cook	depends on !COMPILE_TEST	# too noisy
190f154066bSKees Cook	help
191f154066bSKees Cook	  This option will cause a warning to be printed each time the
192f154066bSKees Cook	  stackleak plugin finds a function it thinks needs to be
193f154066bSKees Cook	  instrumented. This is useful for comparing coverage between
194f154066bSKees Cook	  builds.
195f154066bSKees Cook
196b6a6a377SKees Cookconfig STACKLEAK_TRACK_MIN_SIZE
197b6a6a377SKees Cook	int "Minimum stack frame size of functions tracked by STACKLEAK"
198b6a6a377SKees Cook	default 100
199b6a6a377SKees Cook	range 0 4096
200b6a6a377SKees Cook	depends on GCC_PLUGIN_STACKLEAK
201b6a6a377SKees Cook	help
202b6a6a377SKees Cook	  The STACKLEAK gcc plugin instruments the kernel code for tracking
203b6a6a377SKees Cook	  the lowest border of the kernel stack (and for some other purposes).
204b6a6a377SKees Cook	  It inserts the stackleak_track_stack() call for the functions with
205b6a6a377SKees Cook	  a stack frame size greater than or equal to this parameter.
206b6a6a377SKees Cook	  If unsure, leave the default value 100.
207b6a6a377SKees Cook
208b6a6a377SKees Cookconfig STACKLEAK_METRICS
209b6a6a377SKees Cook	bool "Show STACKLEAK metrics in the /proc file system"
210b6a6a377SKees Cook	depends on GCC_PLUGIN_STACKLEAK
211b6a6a377SKees Cook	depends on PROC_FS
212b6a6a377SKees Cook	help
213b6a6a377SKees Cook	  If this is set, STACKLEAK metrics for every task are available in
214b6a6a377SKees Cook	  the /proc file system. In particular, /proc/<pid>/stack_depth
215b6a6a377SKees Cook	  shows the maximum kernel stack consumption for the current and
216b6a6a377SKees Cook	  previous syscalls. Although this information is not precise, it
217b6a6a377SKees Cook	  can be useful for estimating the STACKLEAK performance impact for
218b6a6a377SKees Cook	  your workloads.
219b6a6a377SKees Cook
220b6a6a377SKees Cookconfig STACKLEAK_RUNTIME_DISABLE
221b6a6a377SKees Cook	bool "Allow runtime disabling of kernel stack erasing"
222b6a6a377SKees Cook	depends on GCC_PLUGIN_STACKLEAK
223b6a6a377SKees Cook	help
224b6a6a377SKees Cook	  This option provides 'stack_erasing' sysctl, which can be used in
225b6a6a377SKees Cook	  runtime to control kernel stack erasing for kernels built with
226b6a6a377SKees Cook	  CONFIG_GCC_PLUGIN_STACKLEAK.
227b6a6a377SKees Cook
2286471384aSAlexander Potapenkoconfig INIT_ON_ALLOC_DEFAULT_ON
2296471384aSAlexander Potapenko	bool "Enable heap memory zeroing on allocation by default"
23042eaa27dSAlexander Potapenko	depends on !KMSAN
2316471384aSAlexander Potapenko	help
2326471384aSAlexander Potapenko	  This has the effect of setting "init_on_alloc=1" on the kernel
2336471384aSAlexander Potapenko	  command line. This can be disabled with "init_on_alloc=0".
2346471384aSAlexander Potapenko	  When "init_on_alloc" is enabled, all page allocator and slab
2356471384aSAlexander Potapenko	  allocator memory will be zeroed when allocated, eliminating
2366471384aSAlexander Potapenko	  many kinds of "uninitialized heap memory" flaws, especially
2376471384aSAlexander Potapenko	  heap content exposures. The performance impact varies by
2386471384aSAlexander Potapenko	  workload, but most cases see <1% impact. Some synthetic
2396471384aSAlexander Potapenko	  workloads have measured as high as 7%.
2406471384aSAlexander Potapenko
2416471384aSAlexander Potapenkoconfig INIT_ON_FREE_DEFAULT_ON
2426471384aSAlexander Potapenko	bool "Enable heap memory zeroing on free by default"
24342eaa27dSAlexander Potapenko	depends on !KMSAN
2446471384aSAlexander Potapenko	help
2456471384aSAlexander Potapenko	  This has the effect of setting "init_on_free=1" on the kernel
2466471384aSAlexander Potapenko	  command line. This can be disabled with "init_on_free=0".
2476471384aSAlexander Potapenko	  Similar to "init_on_alloc", when "init_on_free" is enabled,
2486471384aSAlexander Potapenko	  all page allocator and slab allocator memory will be zeroed
2496471384aSAlexander Potapenko	  when freed, eliminating many kinds of "uninitialized heap memory"
2506471384aSAlexander Potapenko	  flaws, especially heap content exposures. The primary difference
2516471384aSAlexander Potapenko	  with "init_on_free" is that data lifetime in memory is reduced,
2526471384aSAlexander Potapenko	  as anything freed is wiped immediately, making live forensics or
2536471384aSAlexander Potapenko	  cold boot memory attacks unable to recover freed memory contents.
2546471384aSAlexander Potapenko	  The performance impact varies by workload, but is more expensive
2556471384aSAlexander Potapenko	  than "init_on_alloc" due to the negative cache effects of
2566471384aSAlexander Potapenko	  touching "cold" memory areas. Most cases see 3-5% impact. Some
2576471384aSAlexander Potapenko	  synthetic workloads have measured as high as 8%.
2586471384aSAlexander Potapenko
259a82adfd5SKees Cookconfig CC_HAS_ZERO_CALL_USED_REGS
260a82adfd5SKees Cook	def_bool $(cc-option,-fzero-call-used-regs=used-gpr)
261d6a9fb87SNathan Chancellor	# https://github.com/ClangBuiltLinux/linux/issues/1766
262d6a9fb87SNathan Chancellor	# https://github.com/llvm/llvm-project/issues/59242
263d6a9fb87SNathan Chancellor	depends on !CC_IS_CLANG || CLANG_VERSION > 150006
264a82adfd5SKees Cook
265a82adfd5SKees Cookconfig ZERO_CALL_USED_REGS
266a82adfd5SKees Cook	bool "Enable register zeroing on function exit"
267a82adfd5SKees Cook	depends on CC_HAS_ZERO_CALL_USED_REGS
268a82adfd5SKees Cook	help
269a82adfd5SKees Cook	  At the end of functions, always zero any caller-used register
270a82adfd5SKees Cook	  contents. This helps ensure that temporary values are not
271a82adfd5SKees Cook	  leaked beyond the function boundary. This means that register
272a82adfd5SKees Cook	  contents are less likely to be available for side channels
273a82adfd5SKees Cook	  and information exposures. Additionally, this helps reduce the
274a82adfd5SKees Cook	  number of useful ROP gadgets by about 20% (and removes compiler
275a82adfd5SKees Cook	  generated "write-what-where" gadgets) in the resulting kernel
276a82adfd5SKees Cook	  image. This has a less than 1% performance impact on most
277a82adfd5SKees Cook	  workloads. Image size growth depends on architecture, and should
278a82adfd5SKees Cook	  be evaluated for suitability. For example, x86_64 grows by less
279a82adfd5SKees Cook	  than 1%, and arm64 grows by about 5%.
280a82adfd5SKees Cook
2819f671e58SKees Cookendmenu
2829f671e58SKees Cook
283aebc7b0dSMarco Elvermenu "Hardening of kernel data structures"
284aebc7b0dSMarco Elver
285aebc7b0dSMarco Elverconfig LIST_HARDENED
286aebc7b0dSMarco Elver	bool "Check integrity of linked list manipulation"
287aebc7b0dSMarco Elver	help
288aebc7b0dSMarco Elver	  Minimal integrity checking in the linked-list manipulation routines
289aebc7b0dSMarco Elver	  to catch memory corruptions that are not guaranteed to result in an
290aebc7b0dSMarco Elver	  immediate access fault.
291aebc7b0dSMarco Elver
292aebc7b0dSMarco Elver	  If unsure, say N.
293aebc7b0dSMarco Elver
294aa9f10d5SMarco Elverconfig BUG_ON_DATA_CORRUPTION
295aa9f10d5SMarco Elver	bool "Trigger a BUG when data corruption is detected"
296aa9f10d5SMarco Elver	select LIST_HARDENED
297aa9f10d5SMarco Elver	help
298aa9f10d5SMarco Elver	  Select this option if the kernel should BUG when it encounters
299aa9f10d5SMarco Elver	  data corruption in kernel memory structures when they get checked
300aa9f10d5SMarco Elver	  for validity.
301aa9f10d5SMarco Elver
302aa9f10d5SMarco Elver	  If unsure, say N.
303aa9f10d5SMarco Elver
304aebc7b0dSMarco Elverendmenu
305aebc7b0dSMarco Elver
306035f7f87SKees Cookconfig CC_HAS_RANDSTRUCT
307035f7f87SKees Cook	def_bool $(cc-option,-frandomize-layout-seed-file=/dev/null)
30878f7a3fdSEric Biggers	# Randstruct was first added in Clang 15, but it isn't safe to use until
30978f7a3fdSEric Biggers	# Clang 16 due to https://github.com/llvm/llvm-project/issues/60349
31078f7a3fdSEric Biggers	depends on !CC_IS_CLANG || CLANG_VERSION >= 160000
311035f7f87SKees Cook
312595b893eSKees Cookchoice
313595b893eSKees Cook	prompt "Randomize layout of sensitive kernel structures"
314035f7f87SKees Cook	default RANDSTRUCT_FULL if COMPILE_TEST && (GCC_PLUGINS || CC_HAS_RANDSTRUCT)
315595b893eSKees Cook	default RANDSTRUCT_NONE
316595b893eSKees Cook	help
317595b893eSKees Cook	  If you enable this, the layouts of structures that are entirely
318595b893eSKees Cook	  function pointers (and have not been manually annotated with
319595b893eSKees Cook	  __no_randomize_layout), or structures that have been explicitly
320595b893eSKees Cook	  marked with __randomize_layout, will be randomized at compile-time.
321595b893eSKees Cook	  This can introduce the requirement of an additional information
322595b893eSKees Cook	  exposure vulnerability for exploits targeting these structure
323595b893eSKees Cook	  types.
324595b893eSKees Cook
325595b893eSKees Cook	  Enabling this feature will introduce some performance impact,
326595b893eSKees Cook	  slightly increase memory usage, and prevent the use of forensic
327595b893eSKees Cook	  tools like Volatility against the system (unless the kernel
328595b893eSKees Cook	  source tree isn't cleaned after kernel installation).
329595b893eSKees Cook
330be2b34faSKees Cook	  The seed used for compilation is in scripts/basic/randomize.seed.
331be2b34faSKees Cook	  It remains after a "make clean" to allow for external modules to
332be2b34faSKees Cook	  be compiled with the existing seed and will be removed by a
333be2b34faSKees Cook	  "make mrproper" or "make distclean". This file should not be made
334be2b34faSKees Cook	  public, or the structure layout can be determined.
335595b893eSKees Cook
336595b893eSKees Cook	config RANDSTRUCT_NONE
337595b893eSKees Cook		bool "Disable structure layout randomization"
338595b893eSKees Cook		help
339595b893eSKees Cook		  Build normally: no structure layout randomization.
340595b893eSKees Cook
341595b893eSKees Cook	config RANDSTRUCT_FULL
342595b893eSKees Cook		bool "Fully randomize structure layout"
343035f7f87SKees Cook		depends on CC_HAS_RANDSTRUCT || GCC_PLUGINS
344dd3a7ee9SNathan Chancellor		select MODVERSIONS if MODULES && !COMPILE_TEST
345595b893eSKees Cook		help
346595b893eSKees Cook		  Fully randomize the member layout of sensitive
347595b893eSKees Cook		  structures as much as possible, which may have both a
348595b893eSKees Cook		  memory size and performance impact.
349595b893eSKees Cook
350035f7f87SKees Cook		  One difference between the Clang and GCC plugin
351035f7f87SKees Cook		  implementations is the handling of bitfields. The GCC
352035f7f87SKees Cook		  plugin treats them as fully separate variables,
353035f7f87SKees Cook		  introducing sometimes significant padding. Clang tries
354035f7f87SKees Cook		  to keep adjacent bitfields together, but with their bit
355035f7f87SKees Cook		  ordering randomized.
356035f7f87SKees Cook
357595b893eSKees Cook	config RANDSTRUCT_PERFORMANCE
358595b893eSKees Cook		bool "Limit randomization of structure layout to cache-lines"
359595b893eSKees Cook		depends on GCC_PLUGINS
360dd3a7ee9SNathan Chancellor		select MODVERSIONS if MODULES && !COMPILE_TEST
361595b893eSKees Cook		help
362595b893eSKees Cook		  Randomization of sensitive kernel structures will make a
363595b893eSKees Cook		  best effort at restricting randomization to cacheline-sized
364595b893eSKees Cook		  groups of members. It will further not randomize bitfields
365595b893eSKees Cook		  in structures. This reduces the performance hit of RANDSTRUCT
366595b893eSKees Cook		  at the cost of weakened randomization.
367595b893eSKees Cookendchoice
368595b893eSKees Cook
369595b893eSKees Cookconfig RANDSTRUCT
370595b893eSKees Cook	def_bool !RANDSTRUCT_NONE
371595b893eSKees Cook
372595b893eSKees Cookconfig GCC_PLUGIN_RANDSTRUCT
373595b893eSKees Cook	def_bool GCC_PLUGINS && RANDSTRUCT
374595b893eSKees Cook	help
375595b893eSKees Cook	  Use GCC plugin to randomize structure layout.
376595b893eSKees Cook
377595b893eSKees Cook	  This plugin was ported from grsecurity/PaX. More
378595b893eSKees Cook	  information at:
379595b893eSKees Cook	   * https://grsecurity.net/
380595b893eSKees Cook	   * https://pax.grsecurity.net/
381595b893eSKees Cook
3829f671e58SKees Cookendmenu
383