1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 29f671e58SKees Cookmenu "Kernel hardening options" 39f671e58SKees Cook 49f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK 59f671e58SKees Cook bool 69f671e58SKees Cook help 79f671e58SKees Cook While the kernel is built with warnings enabled for any missed 89f671e58SKees Cook stack variable initializations, this warning is silenced for 99f671e58SKees Cook anything passed by reference to another function, under the 109f671e58SKees Cook occasionally misguided assumption that the function will do 119f671e58SKees Cook the initialization. As this regularly leads to exploitable 129f671e58SKees Cook flaws, this plugin is available to identify and zero-initialize 139f671e58SKees Cook such variables, depending on the chosen level of coverage. 149f671e58SKees Cook 159f671e58SKees Cook This plugin was originally ported from grsecurity/PaX. More 169f671e58SKees Cook information at: 179f671e58SKees Cook * https://grsecurity.net/ 189f671e58SKees Cook * https://pax.grsecurity.net/ 199f671e58SKees Cook 209f671e58SKees Cookmenu "Memory initialization" 219f671e58SKees Cook 22f0fe00d4Sglider@google.comconfig CC_HAS_AUTO_VAR_INIT_PATTERN 23709a972eSKees Cook def_bool $(cc-option,-ftrivial-auto-var-init=pattern) 24709a972eSKees Cook 25f0fe00d4Sglider@google.comconfig CC_HAS_AUTO_VAR_INIT_ZERO 26f02003c8SKees Cook # GCC ignores the -enable flag, so we can test for the feature with 27f02003c8SKees Cook # a single invocation using the flag, but drop it as appropriate in 28f02003c8SKees Cook # the Makefile, depending on the presence of Clang. 29f0fe00d4Sglider@google.com def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) 30f0fe00d4Sglider@google.com 319f671e58SKees Cookchoice 329f671e58SKees Cook prompt "Initialize kernel stack variables at function entry" 339f671e58SKees Cook default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS 34f0fe00d4Sglider@google.com default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN 35f02003c8SKees Cook default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO 369f671e58SKees Cook default INIT_STACK_NONE 379f671e58SKees Cook help 389f671e58SKees Cook This option enables initialization of stack variables at 399f671e58SKees Cook function entry time. This has the possibility to have the 409f671e58SKees Cook greatest coverage (since all functions can have their 419f671e58SKees Cook variables initialized), but the performance impact depends 429f671e58SKees Cook on the function calling complexity of a given workload's 439f671e58SKees Cook syscalls. 449f671e58SKees Cook 459f671e58SKees Cook This chooses the level of coverage over classes of potentially 46dcb7c0b9SKees Cook uninitialized variables. The selected class of variable will be 479f671e58SKees Cook initialized before use in a function. 489f671e58SKees Cook 499f671e58SKees Cook config INIT_STACK_NONE 50dcb7c0b9SKees Cook bool "no automatic stack variable initialization (weakest)" 519f671e58SKees Cook help 529f671e58SKees Cook Disable automatic stack variable initialization. 539f671e58SKees Cook This leaves the kernel vulnerable to the standard 549f671e58SKees Cook classes of uninitialized stack variable exploits 559f671e58SKees Cook and information exposures. 569f671e58SKees Cook 579f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_USER 589f671e58SKees Cook bool "zero-init structs marked for userspace (weak)" 598bd51a2bSKees Cook # Plugin can be removed once the kernel only supports GCC 12+ 608bd51a2bSKees Cook depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO 619f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 629f671e58SKees Cook help 639f671e58SKees Cook Zero-initialize any structures on the stack containing 649f671e58SKees Cook a __user attribute. This can prevent some classes of 659f671e58SKees Cook uninitialized stack variable exploits and information 669f671e58SKees Cook exposures, like CVE-2013-2141: 679f671e58SKees Cook https://git.kernel.org/linus/b9e146d8eb3b9eca 689f671e58SKees Cook 699f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_BYREF 709f671e58SKees Cook bool "zero-init structs passed by reference (strong)" 718bd51a2bSKees Cook # Plugin can be removed once the kernel only supports GCC 12+ 728bd51a2bSKees Cook depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO 7302c58773SWalter Wu depends on !(KASAN && KASAN_STACK) 749f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 759f671e58SKees Cook help 769f671e58SKees Cook Zero-initialize any structures on the stack that may 779f671e58SKees Cook be passed by reference and had not already been 789f671e58SKees Cook explicitly initialized. This can prevent most classes 799f671e58SKees Cook of uninitialized stack variable exploits and information 809f671e58SKees Cook exposures, like CVE-2017-1000410: 819f671e58SKees Cook https://git.kernel.org/linus/06e7e776ca4d3654 829f671e58SKees Cook 83173e6ee2SArnd Bergmann As a side-effect, this keeps a lot of variables on the 84173e6ee2SArnd Bergmann stack that can otherwise be optimized out, so combining 85173e6ee2SArnd Bergmann this with CONFIG_KASAN_STACK can lead to a stack overflow 86173e6ee2SArnd Bergmann and is disallowed. 87173e6ee2SArnd Bergmann 889f671e58SKees Cook config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL 89dcb7c0b9SKees Cook bool "zero-init everything passed by reference (very strong)" 908bd51a2bSKees Cook # Plugin can be removed once the kernel only supports GCC 12+ 918bd51a2bSKees Cook depends on GCC_PLUGINS && !CC_HAS_AUTO_VAR_INIT_ZERO 9202c58773SWalter Wu depends on !(KASAN && KASAN_STACK) 939f671e58SKees Cook select GCC_PLUGIN_STRUCTLEAK 949f671e58SKees Cook help 959f671e58SKees Cook Zero-initialize any stack variables that may be passed 969f671e58SKees Cook by reference and had not already been explicitly 979f671e58SKees Cook initialized. This is intended to eliminate all classes 989f671e58SKees Cook of uninitialized stack variable exploits and information 999f671e58SKees Cook exposures. 1009f671e58SKees Cook 101dcb7c0b9SKees Cook As a side-effect, this keeps a lot of variables on the 102dcb7c0b9SKees Cook stack that can otherwise be optimized out, so combining 103dcb7c0b9SKees Cook this with CONFIG_KASAN_STACK can lead to a stack overflow 104dcb7c0b9SKees Cook and is disallowed. 105dcb7c0b9SKees Cook 106f0fe00d4Sglider@google.com config INIT_STACK_ALL_PATTERN 107dcb7c0b9SKees Cook bool "pattern-init everything (strongest)" 108f0fe00d4Sglider@google.com depends on CC_HAS_AUTO_VAR_INIT_PATTERN 109709a972eSKees Cook help 110dcb7c0b9SKees Cook Initializes everything on the stack (including padding) 111dcb7c0b9SKees Cook with a specific debug value. This is intended to eliminate 112dcb7c0b9SKees Cook all classes of uninitialized stack variable exploits and 113dcb7c0b9SKees Cook information exposures, even variables that were warned about 114dcb7c0b9SKees Cook having been left uninitialized. 115709a972eSKees Cook 116f0fe00d4Sglider@google.com Pattern initialization is known to provoke many existing bugs 117f0fe00d4Sglider@google.com related to uninitialized locals, e.g. pointers receive 118dcb7c0b9SKees Cook non-NULL values, buffer sizes and indices are very big. The 119dcb7c0b9SKees Cook pattern is situation-specific; Clang on 64-bit uses 0xAA 120dcb7c0b9SKees Cook repeating for all types and padding except float and double 121dcb7c0b9SKees Cook which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF 122dcb7c0b9SKees Cook repeating for all types and padding. 123f0fe00d4Sglider@google.com 124f0fe00d4Sglider@google.com config INIT_STACK_ALL_ZERO 125dcb7c0b9SKees Cook bool "zero-init everything (strongest and safest)" 126f0fe00d4Sglider@google.com depends on CC_HAS_AUTO_VAR_INIT_ZERO 127f0fe00d4Sglider@google.com help 128dcb7c0b9SKees Cook Initializes everything on the stack (including padding) 129dcb7c0b9SKees Cook with a zero value. This is intended to eliminate all 130dcb7c0b9SKees Cook classes of uninitialized stack variable exploits and 131dcb7c0b9SKees Cook information exposures, even variables that were warned 132dcb7c0b9SKees Cook about having been left uninitialized. 133f0fe00d4Sglider@google.com 134dcb7c0b9SKees Cook Zero initialization provides safe defaults for strings 135dcb7c0b9SKees Cook (immediately NUL-terminated), pointers (NULL), indices 136dcb7c0b9SKees Cook (index 0), and sizes (0 length), so it is therefore more 137dcb7c0b9SKees Cook suitable as a production security mitigation than pattern 138dcb7c0b9SKees Cook initialization. 139f0fe00d4Sglider@google.com 1409f671e58SKees Cookendchoice 1419f671e58SKees Cook 1429f671e58SKees Cookconfig GCC_PLUGIN_STRUCTLEAK_VERBOSE 1439f671e58SKees Cook bool "Report forcefully initialized variables" 1449f671e58SKees Cook depends on GCC_PLUGIN_STRUCTLEAK 1459f671e58SKees Cook depends on !COMPILE_TEST # too noisy 1469f671e58SKees Cook help 1479f671e58SKees Cook This option will cause a warning to be printed each time the 1489f671e58SKees Cook structleak plugin finds a variable it thinks needs to be 1499f671e58SKees Cook initialized. Since not all existing initializers are detected 1509f671e58SKees Cook by the plugin, this can produce false positive warnings. 1519f671e58SKees Cook 152b6a6a377SKees Cookconfig GCC_PLUGIN_STACKLEAK 153b6a6a377SKees Cook bool "Poison kernel stack before returning from syscalls" 154b6a6a377SKees Cook depends on GCC_PLUGINS 155b6a6a377SKees Cook depends on HAVE_ARCH_STACKLEAK 156b6a6a377SKees Cook help 157b6a6a377SKees Cook This option makes the kernel erase the kernel stack before 158b6a6a377SKees Cook returning from system calls. This has the effect of leaving 159b6a6a377SKees Cook the stack initialized to the poison value, which both reduces 160b6a6a377SKees Cook the lifetime of any sensitive stack contents and reduces 161b6a6a377SKees Cook potential for uninitialized stack variable exploits or information 162b6a6a377SKees Cook exposures (it does not cover functions reaching the same stack 163b6a6a377SKees Cook depth as prior functions during the same syscall). This blocks 164b6a6a377SKees Cook most uninitialized stack variable attacks, with the performance 165b6a6a377SKees Cook impact being driven by the depth of the stack usage, rather than 166b6a6a377SKees Cook the function calling complexity. 167b6a6a377SKees Cook 168b6a6a377SKees Cook The performance impact on a single CPU system kernel compilation 169b6a6a377SKees Cook sees a 1% slowdown, other systems and workloads may vary and you 170b6a6a377SKees Cook are advised to test this feature on your expected workload before 171b6a6a377SKees Cook deploying it. 172b6a6a377SKees Cook 173b6a6a377SKees Cook This plugin was ported from grsecurity/PaX. More information at: 174b6a6a377SKees Cook * https://grsecurity.net/ 175b6a6a377SKees Cook * https://pax.grsecurity.net/ 176b6a6a377SKees Cook 177f154066bSKees Cookconfig GCC_PLUGIN_STACKLEAK_VERBOSE 178f154066bSKees Cook bool "Report stack depth analysis instrumentation" if EXPERT 179f154066bSKees Cook depends on GCC_PLUGIN_STACKLEAK 180f154066bSKees Cook depends on !COMPILE_TEST # too noisy 181f154066bSKees Cook help 182f154066bSKees Cook This option will cause a warning to be printed each time the 183f154066bSKees Cook stackleak plugin finds a function it thinks needs to be 184f154066bSKees Cook instrumented. This is useful for comparing coverage between 185f154066bSKees Cook builds. 186f154066bSKees Cook 187b6a6a377SKees Cookconfig STACKLEAK_TRACK_MIN_SIZE 188b6a6a377SKees Cook int "Minimum stack frame size of functions tracked by STACKLEAK" 189b6a6a377SKees Cook default 100 190b6a6a377SKees Cook range 0 4096 191b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 192b6a6a377SKees Cook help 193b6a6a377SKees Cook The STACKLEAK gcc plugin instruments the kernel code for tracking 194b6a6a377SKees Cook the lowest border of the kernel stack (and for some other purposes). 195b6a6a377SKees Cook It inserts the stackleak_track_stack() call for the functions with 196b6a6a377SKees Cook a stack frame size greater than or equal to this parameter. 197b6a6a377SKees Cook If unsure, leave the default value 100. 198b6a6a377SKees Cook 199b6a6a377SKees Cookconfig STACKLEAK_METRICS 200b6a6a377SKees Cook bool "Show STACKLEAK metrics in the /proc file system" 201b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 202b6a6a377SKees Cook depends on PROC_FS 203b6a6a377SKees Cook help 204b6a6a377SKees Cook If this is set, STACKLEAK metrics for every task are available in 205b6a6a377SKees Cook the /proc file system. In particular, /proc/<pid>/stack_depth 206b6a6a377SKees Cook shows the maximum kernel stack consumption for the current and 207b6a6a377SKees Cook previous syscalls. Although this information is not precise, it 208b6a6a377SKees Cook can be useful for estimating the STACKLEAK performance impact for 209b6a6a377SKees Cook your workloads. 210b6a6a377SKees Cook 211b6a6a377SKees Cookconfig STACKLEAK_RUNTIME_DISABLE 212b6a6a377SKees Cook bool "Allow runtime disabling of kernel stack erasing" 213b6a6a377SKees Cook depends on GCC_PLUGIN_STACKLEAK 214b6a6a377SKees Cook help 215b6a6a377SKees Cook This option provides 'stack_erasing' sysctl, which can be used in 216b6a6a377SKees Cook runtime to control kernel stack erasing for kernels built with 217b6a6a377SKees Cook CONFIG_GCC_PLUGIN_STACKLEAK. 218b6a6a377SKees Cook 2196471384aSAlexander Potapenkoconfig INIT_ON_ALLOC_DEFAULT_ON 2206471384aSAlexander Potapenko bool "Enable heap memory zeroing on allocation by default" 2216471384aSAlexander Potapenko help 2226471384aSAlexander Potapenko This has the effect of setting "init_on_alloc=1" on the kernel 2236471384aSAlexander Potapenko command line. This can be disabled with "init_on_alloc=0". 2246471384aSAlexander Potapenko When "init_on_alloc" is enabled, all page allocator and slab 2256471384aSAlexander Potapenko allocator memory will be zeroed when allocated, eliminating 2266471384aSAlexander Potapenko many kinds of "uninitialized heap memory" flaws, especially 2276471384aSAlexander Potapenko heap content exposures. The performance impact varies by 2286471384aSAlexander Potapenko workload, but most cases see <1% impact. Some synthetic 2296471384aSAlexander Potapenko workloads have measured as high as 7%. 2306471384aSAlexander Potapenko 2316471384aSAlexander Potapenkoconfig INIT_ON_FREE_DEFAULT_ON 2326471384aSAlexander Potapenko bool "Enable heap memory zeroing on free by default" 2336471384aSAlexander Potapenko help 2346471384aSAlexander Potapenko This has the effect of setting "init_on_free=1" on the kernel 2356471384aSAlexander Potapenko command line. This can be disabled with "init_on_free=0". 2366471384aSAlexander Potapenko Similar to "init_on_alloc", when "init_on_free" is enabled, 2376471384aSAlexander Potapenko all page allocator and slab allocator memory will be zeroed 2386471384aSAlexander Potapenko when freed, eliminating many kinds of "uninitialized heap memory" 2396471384aSAlexander Potapenko flaws, especially heap content exposures. The primary difference 2406471384aSAlexander Potapenko with "init_on_free" is that data lifetime in memory is reduced, 2416471384aSAlexander Potapenko as anything freed is wiped immediately, making live forensics or 2426471384aSAlexander Potapenko cold boot memory attacks unable to recover freed memory contents. 2436471384aSAlexander Potapenko The performance impact varies by workload, but is more expensive 2446471384aSAlexander Potapenko than "init_on_alloc" due to the negative cache effects of 2456471384aSAlexander Potapenko touching "cold" memory areas. Most cases see 3-5% impact. Some 2466471384aSAlexander Potapenko synthetic workloads have measured as high as 8%. 2476471384aSAlexander Potapenko 248a82adfd5SKees Cookconfig CC_HAS_ZERO_CALL_USED_REGS 249a82adfd5SKees Cook def_bool $(cc-option,-fzero-call-used-regs=used-gpr) 250a82adfd5SKees Cook 251a82adfd5SKees Cookconfig ZERO_CALL_USED_REGS 252a82adfd5SKees Cook bool "Enable register zeroing on function exit" 253a82adfd5SKees Cook depends on CC_HAS_ZERO_CALL_USED_REGS 254a82adfd5SKees Cook help 255a82adfd5SKees Cook At the end of functions, always zero any caller-used register 256a82adfd5SKees Cook contents. This helps ensure that temporary values are not 257a82adfd5SKees Cook leaked beyond the function boundary. This means that register 258a82adfd5SKees Cook contents are less likely to be available for side channels 259a82adfd5SKees Cook and information exposures. Additionally, this helps reduce the 260a82adfd5SKees Cook number of useful ROP gadgets by about 20% (and removes compiler 261a82adfd5SKees Cook generated "write-what-where" gadgets) in the resulting kernel 262a82adfd5SKees Cook image. This has a less than 1% performance impact on most 263a82adfd5SKees Cook workloads. Image size growth depends on architecture, and should 264a82adfd5SKees Cook be evaluated for suitability. For example, x86_64 grows by less 265a82adfd5SKees Cook than 1%, and arm64 grows by about 5%. 266a82adfd5SKees Cook 2679f671e58SKees Cookendmenu 2689f671e58SKees Cook 269595b893eSKees Cookchoice 270595b893eSKees Cook prompt "Randomize layout of sensitive kernel structures" 271595b893eSKees Cook default RANDSTRUCT_FULL if COMPILE_TEST && GCC_PLUGINS 272595b893eSKees Cook default RANDSTRUCT_NONE 273595b893eSKees Cook help 274595b893eSKees Cook If you enable this, the layouts of structures that are entirely 275595b893eSKees Cook function pointers (and have not been manually annotated with 276595b893eSKees Cook __no_randomize_layout), or structures that have been explicitly 277595b893eSKees Cook marked with __randomize_layout, will be randomized at compile-time. 278595b893eSKees Cook This can introduce the requirement of an additional information 279595b893eSKees Cook exposure vulnerability for exploits targeting these structure 280595b893eSKees Cook types. 281595b893eSKees Cook 282595b893eSKees Cook Enabling this feature will introduce some performance impact, 283595b893eSKees Cook slightly increase memory usage, and prevent the use of forensic 284595b893eSKees Cook tools like Volatility against the system (unless the kernel 285595b893eSKees Cook source tree isn't cleaned after kernel installation). 286595b893eSKees Cook 287*be2b34faSKees Cook The seed used for compilation is in scripts/basic/randomize.seed. 288*be2b34faSKees Cook It remains after a "make clean" to allow for external modules to 289*be2b34faSKees Cook be compiled with the existing seed and will be removed by a 290*be2b34faSKees Cook "make mrproper" or "make distclean". This file should not be made 291*be2b34faSKees Cook public, or the structure layout can be determined. 292595b893eSKees Cook 293595b893eSKees Cook config RANDSTRUCT_NONE 294595b893eSKees Cook bool "Disable structure layout randomization" 295595b893eSKees Cook help 296595b893eSKees Cook Build normally: no structure layout randomization. 297595b893eSKees Cook 298595b893eSKees Cook config RANDSTRUCT_FULL 299595b893eSKees Cook bool "Fully randomize structure layout" 300595b893eSKees Cook depends on GCC_PLUGINS 301595b893eSKees Cook select MODVERSIONS if MODULES 302595b893eSKees Cook help 303595b893eSKees Cook Fully randomize the member layout of sensitive 304595b893eSKees Cook structures as much as possible, which may have both a 305595b893eSKees Cook memory size and performance impact. 306595b893eSKees Cook 307595b893eSKees Cook config RANDSTRUCT_PERFORMANCE 308595b893eSKees Cook bool "Limit randomization of structure layout to cache-lines" 309595b893eSKees Cook depends on GCC_PLUGINS 310595b893eSKees Cook select MODVERSIONS if MODULES 311595b893eSKees Cook help 312595b893eSKees Cook Randomization of sensitive kernel structures will make a 313595b893eSKees Cook best effort at restricting randomization to cacheline-sized 314595b893eSKees Cook groups of members. It will further not randomize bitfields 315595b893eSKees Cook in structures. This reduces the performance hit of RANDSTRUCT 316595b893eSKees Cook at the cost of weakened randomization. 317595b893eSKees Cookendchoice 318595b893eSKees Cook 319595b893eSKees Cookconfig RANDSTRUCT 320595b893eSKees Cook def_bool !RANDSTRUCT_NONE 321595b893eSKees Cook 322595b893eSKees Cookconfig GCC_PLUGIN_RANDSTRUCT 323595b893eSKees Cook def_bool GCC_PLUGINS && RANDSTRUCT 324595b893eSKees Cook help 325595b893eSKees Cook Use GCC plugin to randomize structure layout. 326595b893eSKees Cook 327595b893eSKees Cook This plugin was ported from grsecurity/PaX. More 328595b893eSKees Cook information at: 329595b893eSKees Cook * https://grsecurity.net/ 330595b893eSKees Cook * https://pax.grsecurity.net/ 331595b893eSKees Cook 3329f671e58SKees Cookendmenu 333