1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 29f671e58SKees Cookmenu "Kernel hardening options" 39f671e58SKees Cook 49f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK 59f671e58SKees Cook bool 69f671e58SKees Cook help 79f671e58SKees Cook While the kernel is built with warnings enabled for any missed 89f671e58SKees Cook stack variable initializations, this warning is silenced for 99f671e58SKees Cook anything passed by reference to another function, under the 109f671e58SKees Cook occasionally misguided assumption that the function will do 119f671e58SKees Cook the initialization. As this regularly leads to exploitable 129f671e58SKees Cook flaws, this plugin is available to identify and zero-initialize 139f671e58SKees Cook such variables, depending on the chosen level of coverage. 149f671e58SKees Cook 159f671e58SKees Cook This plugin was originally ported from grsecurity/PaX. More 169f671e58SKees Cook information at: 179f671e58SKees Cook * https://grsecurity.net/ 189f671e58SKees Cook * https://pax.grsecurity.net/ 199f671e58SKees Cook 209f671e58SKees Cookmenu "Memory initialization" 219f671e58SKees Cook 22f0fe00d4Sglider@google.comconfig CC_HAS_AUTO_VAR_INIT_PATTERN 23709a972eSKees Cook def_bool $(cc-option,-ftrivial-auto-var-init=pattern) 24709a972eSKees Cook 25f0fe00d4Sglider@google.comconfig CC_HAS_AUTO_VAR_INIT_ZERO 26f02003c8SKees Cook # GCC ignores the -enable flag, so we can test for the feature with 27f02003c8SKees Cook # a single invocation using the flag, but drop it as appropriate in 28f02003c8SKees Cook # the Makefile, depending on the presence of Clang. 29f0fe00d4Sglider@google.com def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) 30f0fe00d4Sglider@google.com 319f671e58SKees Cookchoice 329f671e58SKees Cook prompt "Initialize kernel stack variables at function entry" 339f671e58SKees Cook default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS 34f0fe00d4Sglider@google.com default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN 35f02003c8SKees Cook default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO 369f671e58SKees Cook default INIT_STACK_NONE 379f671e58SKees Cook help 389f671e58SKees Cook This option enables initialization of stack variables at 399f671e58SKees Cook function entry time. This has the possibility to have the 409f671e58SKees Cook greatest coverage (since all functions can have their 419f671e58SKees Cook variables initialized), but the performance impact depends 429f671e58SKees Cook on the function calling complexity of a given workload's 439f671e58SKees Cook syscalls. 449f671e58SKees Cook 459f671e58SKees Cook This chooses the level of coverage over classes of potentially 46dcb7c0b9SKees Cook uninitialized variables. The selected class of variable will be 479f671e58SKees Cook initialized before use in a function. 489f671e58SKees Cook 499f671e58SKees Cook config INIT_STACK_NONE 50dcb7c0b9SKees Cook bool "no automatic stack variable initialization (weakest)" 519f671e58SKees Cook help 529f671e58SKees Cook Disable automatic stack variable initialization. 539f671e58SKees Cook This leaves the kernel vulnerable to the standard 549f671e58SKees Cook classes of uninitialized stack variable exploits 559f671e58SKees Cook and information exposures. 569f671e58SKees Cook 579f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_USER 589f671e58SKees Cook bool "zero-init structs marked for userspace (weak)" 59*8bd51a2bSKees Cook # Plugin can be removed once the kernel only supports GCC 12+ 60*8bd51a2bSKees Cook depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO 619f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 629f671e58SKees Cook help 639f671e58SKees Cook Zero-initialize any structures on the stack containing 649f671e58SKees Cook a __user attribute. This can prevent some classes of 659f671e58SKees Cook uninitialized stack variable exploits and information 669f671e58SKees Cook exposures, like CVE-2013-2141: 679f671e58SKees Cook https://git.kernel.org/linus/b9e146d8eb3b9eca 689f671e58SKees Cook 699f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_BYREF 709f671e58SKees Cook bool "zero-init structs passed by reference (strong)" 71*8bd51a2bSKees Cook # Plugin can be removed once the kernel only supports GCC 12+ 72*8bd51a2bSKees Cook depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO 7302c58773SWalter Wu depends on !(KASAN && KASAN_STACK) 749f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 759f671e58SKees Cook help 769f671e58SKees Cook Zero-initialize any structures on the stack that may 779f671e58SKees Cook be passed by reference and had not already been 789f671e58SKees Cook explicitly initialized. This can prevent most classes 799f671e58SKees Cook of uninitialized stack variable exploits and information 809f671e58SKees Cook exposures, like CVE-2017-1000410: 819f671e58SKees Cook https://git.kernel.org/linus/06e7e776ca4d3654 829f671e58SKees Cook 83173e6ee2SArnd Bergmann As a side-effect, this keeps a lot of variables on the 84173e6ee2SArnd Bergmann stack that can otherwise be optimized out, so combining 85173e6ee2SArnd Bergmann this with CONFIG_KASAN_STACK can lead to a stack overflow 86173e6ee2SArnd Bergmann and is disallowed. 87173e6ee2SArnd Bergmann 889f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL 89dcb7c0b9SKees Cook bool "zero-init everything passed by reference (very strong)" 90*8bd51a2bSKees Cook # Plugin can be removed once the kernel only supports GCC 12+ 91*8bd51a2bSKees Cook depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO 9202c58773SWalter Wu depends on !(KASAN && KASAN_STACK) 939f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 949f671e58SKees Cook help 959f671e58SKees Cook Zero-initialize any stack variables that may be passed 969f671e58SKees Cook by reference and had not already been explicitly 979f671e58SKees Cook initialized. This is intended to eliminate all classes 989f671e58SKees Cook of uninitialized stack variable exploits and information 999f671e58SKees Cook exposures. 1009f671e58SKees Cook 101dcb7c0b9SKees Cook As a side-effect, this keeps a lot of variables on the 102dcb7c0b9SKees Cook stack that can otherwise be optimized out, so combining 103dcb7c0b9SKees Cook this with CONFIG_KASAN_STACK can lead to a stack overflow 104dcb7c0b9SKees Cook and is disallowed. 105dcb7c0b9SKees Cook 106f0fe00d4Sglider@google.com config INIT_STACK_ALL_PATTERN 107dcb7c0b9SKees Cook bool "pattern-init everything (strongest)" 108f0fe00d4Sglider@google.com depends on CC_HAS_AUTO_VAR_INIT_PATTERN 109709a972eSKees Cook help 110dcb7c0b9SKees Cook Initializes everything on the stack (including padding) 111dcb7c0b9SKees Cook with a specific debug value. This is intended to eliminate 112dcb7c0b9SKees Cook all classes of uninitialized stack variable exploits and 113dcb7c0b9SKees Cook information exposures, even variables that were warned about 114dcb7c0b9SKees Cook having been left uninitialized. 115709a972eSKees Cook 116f0fe00d4Sglider@google.com Pattern initialization is known to provoke many existing bugs 117f0fe00d4Sglider@google.com related to uninitialized locals, e.g. pointers receive 118dcb7c0b9SKees Cook non-NULL values, buffer sizes and indices are very big. The 119dcb7c0b9SKees Cook pattern is situation-specific; Clang on 64-bit uses 0xAA 120dcb7c0b9SKees Cook repeating for all types and padding except float and double 121dcb7c0b9SKees Cook which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF 122dcb7c0b9SKees Cook repeating for all types and padding. 123f0fe00d4Sglider@google.com 124f0fe00d4Sglider@google.com config INIT_STACK_ALL_ZERO 125dcb7c0b9SKees Cook bool "zero-init everything (strongest and safest)" 126f0fe00d4Sglider@google.com depends on CC_HAS_AUTO_VAR_INIT_ZERO 127f0fe00d4Sglider@google.com help 128dcb7c0b9SKees Cook Initializes everything on the stack (including padding) 129dcb7c0b9SKees Cook with a zero value. This is intended to eliminate all 130dcb7c0b9SKees Cook classes of uninitialized stack variable exploits and 131dcb7c0b9SKees Cook information exposures, even variables that were warned 132dcb7c0b9SKees Cook about having been left uninitialized. 133f0fe00d4Sglider@google.com 134dcb7c0b9SKees Cook Zero initialization provides safe defaults for strings 135dcb7c0b9SKees Cook (immediately NUL-terminated), pointers (NULL), indices 136dcb7c0b9SKees Cook (index 0), and sizes (0 length), so it is therefore more 137dcb7c0b9SKees Cook suitable as a production security mitigation than pattern 138dcb7c0b9SKees Cook initialization. 139f0fe00d4Sglider@google.com 1409f671e58SKees Cookendchoice 1419f671e58SKees Cook 1429f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK_VERBOSE 1439f671e58SKees Cook bool "Report forcefully initialized variables" 1449f671e58SKees Cook depends on GCC_PLUGIN_STRUCTLEAK 1459f671e58SKees Cook depends on !COMPILE_TEST # too noisy 1469f671e58SKees Cook help 1479f671e58SKees Cook This option will cause a warning to be printed each time the 1489f671e58SKees Cook structleak plugin finds a variable it thinks needs to be 1499f671e58SKees Cook initialized. Since not all existing initializers are detected 1509f671e58SKees Cook by the plugin, this can produce false positive warnings. 1519f671e58SKees Cook 152b6a6a377SKees Cookconfig GCC_PLUGIN_STACKLEAK 153b6a6a377SKees Cook bool "Poison kernel stack before returning from syscalls" 154b6a6a377SKees Cook depends on GCC_PLUGINS 155b6a6a377SKees Cook depends on HAVE_ARCH_STACKLEAK 156b6a6a377SKees Cook help 157b6a6a377SKees Cook This option makes the kernel erase the kernel stack before 158b6a6a377SKees Cook returning from system calls. This has the effect of leaving 159b6a6a377SKees Cook the stack initialized to the poison value, which both reduces 160b6a6a377SKees Cook the lifetime of any sensitive stack contents and reduces 161b6a6a377SKees Cook potential for uninitialized stack variable exploits or information 162b6a6a377SKees Cook exposures (it does not cover functions reaching the same stack 163b6a6a377SKees Cook depth as prior functions during the same syscall). This blocks 164b6a6a377SKees Cook most uninitialized stack variable attacks, with the performance 165b6a6a377SKees Cook impact being driven by the depth of the stack usage, rather than 166b6a6a377SKees Cook the function calling complexity. 167b6a6a377SKees Cook 168b6a6a377SKees Cook The performance impact on a single CPU system kernel compilation 169b6a6a377SKees Cook sees a 1% slowdown, other systems and workloads may vary and you 170b6a6a377SKees Cook are advised to test this feature on your expected workload before 171b6a6a377SKees Cook deploying it. 172b6a6a377SKees Cook 173b6a6a377SKees Cook This plugin was ported from grsecurity/PaX. More information at: 174b6a6a377SKees Cook * https://grsecurity.net/ 175b6a6a377SKees Cook * https://pax.grsecurity.net/ 176b6a6a377SKees Cook 177b6a6a377SKees Cookconfig STACKLEAK_TRACK_MIN_SIZE 178b6a6a377SKees Cook int "Minimum stack frame size of functions tracked by STACKLEAK" 179b6a6a377SKees Cook default 100 180b6a6a377SKees Cook range 0 4096 181b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 182b6a6a377SKees Cook help 183b6a6a377SKees Cook The STACKLEAK gcc plugin instruments the kernel code for tracking 184b6a6a377SKees Cook the lowest border of the kernel stack (and for some other purposes). 185b6a6a377SKees Cook It inserts the stackleak_track_stack() call for the functions with 186b6a6a377SKees Cook a stack frame size greater than or equal to this parameter. 187b6a6a377SKees Cook If unsure, leave the default value 100. 188b6a6a377SKees Cook 189b6a6a377SKees Cookconfig STACKLEAK_METRICS 190b6a6a377SKees Cook bool "Show STACKLEAK metrics in the /proc file system" 191b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 192b6a6a377SKees Cook depends on PROC_FS 193b6a6a377SKees Cook help 194b6a6a377SKees Cook If this is set, STACKLEAK metrics for every task are available in 195b6a6a377SKees Cook the /proc file system. In particular, /proc/<pid>/stack_depth 196b6a6a377SKees Cook shows the maximum kernel stack consumption for the current and 197b6a6a377SKees Cook previous syscalls. Although this information is not precise, it 198b6a6a377SKees Cook can be useful for estimating the STACKLEAK performance impact for 199b6a6a377SKees Cook your workloads. 200b6a6a377SKees Cook 201b6a6a377SKees Cookconfig STACKLEAK_RUNTIME_DISABLE 202b6a6a377SKees Cook bool "Allow runtime disabling of kernel stack erasing" 203b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 204b6a6a377SKees Cook help 205b6a6a377SKees Cook This option provides 'stack_erasing' sysctl, which can be used in 206b6a6a377SKees Cook runtime to control kernel stack erasing for kernels built with 207b6a6a377SKees Cook CONFIG_GCC_PLUGIN_STACKLEAK. 208b6a6a377SKees Cook 2096471384aSAlexander Potapenkoconfig INIT_ON_ALLOC_DEFAULT_ON 2106471384aSAlexander Potapenko bool "Enable heap memory zeroing on allocation by default" 2116471384aSAlexander Potapenko help 2126471384aSAlexander Potapenko This has the effect of setting "init_on_alloc=1" on the kernel 2136471384aSAlexander Potapenko command line. This can be disabled with "init_on_alloc=0". 2146471384aSAlexander Potapenko When "init_on_alloc" is enabled, all page allocator and slab 2156471384aSAlexander Potapenko allocator memory will be zeroed when allocated, eliminating 2166471384aSAlexander Potapenko many kinds of "uninitialized heap memory" flaws, especially 2176471384aSAlexander Potapenko heap content exposures. The performance impact varies by 2186471384aSAlexander Potapenko workload, but most cases see <1% impact. Some synthetic 2196471384aSAlexander Potapenko workloads have measured as high as 7%. 2206471384aSAlexander Potapenko 2216471384aSAlexander Potapenkoconfig INIT_ON_FREE_DEFAULT_ON 2226471384aSAlexander Potapenko bool "Enable heap memory zeroing on free by default" 2236471384aSAlexander Potapenko help 2246471384aSAlexander Potapenko This has the effect of setting "init_on_free=1" on the kernel 2256471384aSAlexander Potapenko command line. This can be disabled with "init_on_free=0". 2266471384aSAlexander Potapenko Similar to "init_on_alloc", when "init_on_free" is enabled, 2276471384aSAlexander Potapenko all page allocator and slab allocator memory will be zeroed 2286471384aSAlexander Potapenko when freed, eliminating many kinds of "uninitialized heap memory" 2296471384aSAlexander Potapenko flaws, especially heap content exposures. The primary difference 2306471384aSAlexander Potapenko with "init_on_free" is that data lifetime in memory is reduced, 2316471384aSAlexander Potapenko as anything freed is wiped immediately, making live forensics or 2326471384aSAlexander Potapenko cold boot memory attacks unable to recover freed memory contents. 2336471384aSAlexander Potapenko The performance impact varies by workload, but is more expensive 2346471384aSAlexander Potapenko than "init_on_alloc" due to the negative cache effects of 2356471384aSAlexander Potapenko touching "cold" memory areas. Most cases see 3-5% impact. Some 2366471384aSAlexander Potapenko synthetic workloads have measured as high as 8%. 2376471384aSAlexander Potapenko 238a82adfd5SKees Cookconfig CC_HAS_ZERO_CALL_USED_REGS 239a82adfd5SKees Cook def_bool $(cc-option,-fzero-call-used-regs=used-gpr) 240a82adfd5SKees Cook 241a82adfd5SKees Cookconfig ZERO_CALL_USED_REGS 242a82adfd5SKees Cook bool "Enable register zeroing on function exit" 243a82adfd5SKees Cook depends on CC_HAS_ZERO_CALL_USED_REGS 244a82adfd5SKees Cook help 245a82adfd5SKees Cook At the end of functions, always zero any caller-used register 246a82adfd5SKees Cook contents. This helps ensure that temporary values are not 247a82adfd5SKees Cook leaked beyond the function boundary. This means that register 248a82adfd5SKees Cook contents are less likely to be available for side channels 249a82adfd5SKees Cook and information exposures. Additionally, this helps reduce the 250a82adfd5SKees Cook number of useful ROP gadgets by about 20% (and removes compiler 251a82adfd5SKees Cook generated "write-what-where" gadgets) in the resulting kernel 252a82adfd5SKees Cook image. This has a less than 1% performance impact on most 253a82adfd5SKees Cook workloads. Image size growth depends on architecture, and should 254a82adfd5SKees Cook be evaluated for suitability. For example, x86_64 grows by less 255a82adfd5SKees Cook than 1%, and arm64 grows by about 5%. 256a82adfd5SKees Cook 2579f671e58SKees Cookendmenu 2589f671e58SKees Cook 2599f671e58SKees Cookendmenu 260