19f671e58SKees Cookmenu "Kernel hardening options" 29f671e58SKees Cook 39f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK 49f671e58SKees Cook bool 59f671e58SKees Cook help 69f671e58SKees Cook While the kernel is built with warnings enabled for any missed 79f671e58SKees Cook stack variable initializations, this warning is silenced for 89f671e58SKees Cook anything passed by reference to another function, under the 99f671e58SKees Cook occasionally misguided assumption that the function will do 109f671e58SKees Cook the initialization. As this regularly leads to exploitable 119f671e58SKees Cook flaws, this plugin is available to identify and zero-initialize 129f671e58SKees Cook such variables, depending on the chosen level of coverage. 139f671e58SKees Cook 149f671e58SKees Cook This plugin was originally ported from grsecurity/PaX. More 159f671e58SKees Cook information at: 169f671e58SKees Cook * https://grsecurity.net/ 179f671e58SKees Cook * https://pax.grsecurity.net/ 189f671e58SKees Cook 199f671e58SKees Cookmenu "Memory initialization" 209f671e58SKees Cook 219f671e58SKees Cookchoice 229f671e58SKees Cook prompt "Initialize kernel stack variables at function entry" 239f671e58SKees Cook default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS 249f671e58SKees Cook default INIT_STACK_NONE 259f671e58SKees Cook help 269f671e58SKees Cook This option enables initialization of stack variables at 279f671e58SKees Cook function entry time. This has the possibility to have the 289f671e58SKees Cook greatest coverage (since all functions can have their 299f671e58SKees Cook variables initialized), but the performance impact depends 309f671e58SKees Cook on the function calling complexity of a given workload's 319f671e58SKees Cook syscalls. 329f671e58SKees Cook 339f671e58SKees Cook This chooses the level of coverage over classes of potentially 349f671e58SKees Cook uninitialized variables. The selected class will be 359f671e58SKees Cook initialized before use in a function. 369f671e58SKees Cook 379f671e58SKees Cook config INIT_STACK_NONE 389f671e58SKees Cook bool "no automatic initialization (weakest)" 399f671e58SKees Cook help 409f671e58SKees Cook Disable automatic stack variable initialization. 419f671e58SKees Cook This leaves the kernel vulnerable to the standard 429f671e58SKees Cook classes of uninitialized stack variable exploits 439f671e58SKees Cook and information exposures. 449f671e58SKees Cook 459f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_USER 469f671e58SKees Cook bool "zero-init structs marked for userspace (weak)" 479f671e58SKees Cook depends on GCC_PLUGINS 489f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 499f671e58SKees Cook help 509f671e58SKees Cook Zero-initialize any structures on the stack containing 519f671e58SKees Cook a __user attribute. This can prevent some classes of 529f671e58SKees Cook uninitialized stack variable exploits and information 539f671e58SKees Cook exposures, like CVE-2013-2141: 549f671e58SKees Cook https://git.kernel.org/linus/b9e146d8eb3b9eca 559f671e58SKees Cook 569f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_BYREF 579f671e58SKees Cook bool "zero-init structs passed by reference (strong)" 589f671e58SKees Cook depends on GCC_PLUGINS 599f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 609f671e58SKees Cook help 619f671e58SKees Cook Zero-initialize any structures on the stack that may 629f671e58SKees Cook be passed by reference and had not already been 639f671e58SKees Cook explicitly initialized. This can prevent most classes 649f671e58SKees Cook of uninitialized stack variable exploits and information 659f671e58SKees Cook exposures, like CVE-2017-1000410: 669f671e58SKees Cook https://git.kernel.org/linus/06e7e776ca4d3654 679f671e58SKees Cook 689f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL 699f671e58SKees Cook bool "zero-init anything passed by reference (very strong)" 709f671e58SKees Cook depends on GCC_PLUGINS 719f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 729f671e58SKees Cook help 739f671e58SKees Cook Zero-initialize any stack variables that may be passed 749f671e58SKees Cook by reference and had not already been explicitly 759f671e58SKees Cook initialized. This is intended to eliminate all classes 769f671e58SKees Cook of uninitialized stack variable exploits and information 779f671e58SKees Cook exposures. 789f671e58SKees Cook 799f671e58SKees Cookendchoice 809f671e58SKees Cook 819f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK_VERBOSE 829f671e58SKees Cook bool "Report forcefully initialized variables" 839f671e58SKees Cook depends on GCC_PLUGIN_STRUCTLEAK 849f671e58SKees Cook depends on !COMPILE_TEST # too noisy 859f671e58SKees Cook help 869f671e58SKees Cook This option will cause a warning to be printed each time the 879f671e58SKees Cook structleak plugin finds a variable it thinks needs to be 889f671e58SKees Cook initialized. Since not all existing initializers are detected 899f671e58SKees Cook by the plugin, this can produce false positive warnings. 909f671e58SKees Cook 91*b6a6a377SKees Cookconfig GCC_PLUGIN_STACKLEAK 92*b6a6a377SKees Cook bool "Poison kernel stack before returning from syscalls" 93*b6a6a377SKees Cook depends on GCC_PLUGINS 94*b6a6a377SKees Cook depends on HAVE_ARCH_STACKLEAK 95*b6a6a377SKees Cook help 96*b6a6a377SKees Cook This option makes the kernel erase the kernel stack before 97*b6a6a377SKees Cook returning from system calls. This has the effect of leaving 98*b6a6a377SKees Cook the stack initialized to the poison value, which both reduces 99*b6a6a377SKees Cook the lifetime of any sensitive stack contents and reduces 100*b6a6a377SKees Cook potential for uninitialized stack variable exploits or information 101*b6a6a377SKees Cook exposures (it does not cover functions reaching the same stack 102*b6a6a377SKees Cook depth as prior functions during the same syscall). This blocks 103*b6a6a377SKees Cook most uninitialized stack variable attacks, with the performance 104*b6a6a377SKees Cook impact being driven by the depth of the stack usage, rather than 105*b6a6a377SKees Cook the function calling complexity. 106*b6a6a377SKees Cook 107*b6a6a377SKees Cook The performance impact on a single CPU system kernel compilation 108*b6a6a377SKees Cook sees a 1% slowdown, other systems and workloads may vary and you 109*b6a6a377SKees Cook are advised to test this feature on your expected workload before 110*b6a6a377SKees Cook deploying it. 111*b6a6a377SKees Cook 112*b6a6a377SKees Cook This plugin was ported from grsecurity/PaX. More information at: 113*b6a6a377SKees Cook * https://grsecurity.net/ 114*b6a6a377SKees Cook * https://pax.grsecurity.net/ 115*b6a6a377SKees Cook 116*b6a6a377SKees Cookconfig STACKLEAK_TRACK_MIN_SIZE 117*b6a6a377SKees Cook int "Minimum stack frame size of functions tracked by STACKLEAK" 118*b6a6a377SKees Cook default 100 119*b6a6a377SKees Cook range 0 4096 120*b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 121*b6a6a377SKees Cook help 122*b6a6a377SKees Cook The STACKLEAK gcc plugin instruments the kernel code for tracking 123*b6a6a377SKees Cook the lowest border of the kernel stack (and for some other purposes). 124*b6a6a377SKees Cook It inserts the stackleak_track_stack() call for the functions with 125*b6a6a377SKees Cook a stack frame size greater than or equal to this parameter. 126*b6a6a377SKees Cook If unsure, leave the default value 100. 127*b6a6a377SKees Cook 128*b6a6a377SKees Cookconfig STACKLEAK_METRICS 129*b6a6a377SKees Cook bool "Show STACKLEAK metrics in the /proc file system" 130*b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 131*b6a6a377SKees Cook depends on PROC_FS 132*b6a6a377SKees Cook help 133*b6a6a377SKees Cook If this is set, STACKLEAK metrics for every task are available in 134*b6a6a377SKees Cook the /proc file system. In particular, /proc/<pid>/stack_depth 135*b6a6a377SKees Cook shows the maximum kernel stack consumption for the current and 136*b6a6a377SKees Cook previous syscalls. Although this information is not precise, it 137*b6a6a377SKees Cook can be useful for estimating the STACKLEAK performance impact for 138*b6a6a377SKees Cook your workloads. 139*b6a6a377SKees Cook 140*b6a6a377SKees Cookconfig STACKLEAK_RUNTIME_DISABLE 141*b6a6a377SKees Cook bool "Allow runtime disabling of kernel stack erasing" 142*b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 143*b6a6a377SKees Cook help 144*b6a6a377SKees Cook This option provides 'stack_erasing' sysctl, which can be used in 145*b6a6a377SKees Cook runtime to control kernel stack erasing for kernels built with 146*b6a6a377SKees Cook CONFIG_GCC_PLUGIN_STACKLEAK. 147*b6a6a377SKees Cook 1489f671e58SKees Cookendmenu 1499f671e58SKees Cook 1509f671e58SKees Cookendmenu 151