215199e3d9
Inspired by Salvatore Mesoraca's earlier[1] efforts to provide some in-tree guidance for kernel hardening Kconfig options, add a new fragment named "hardening-basic.config" (along with some arch-specific fragments) that enable a basic set of kernel hardening options that have the least (or no) performance impact and remove a reasonable set of legacy APIs. Using this fragment is as simple as running "make hardening.config". More extreme fragments can be added[2] in the future to cover all the recognized hardening options, and more per-architecture files can be added too. For now, document the fragments directly via comments. Perhaps .rst documentation can be generated from them in the future (rather than the other way around). [1] https://lore.kernel.org/kernel-hardening/1536516257-30871-1-git-send-email-s.mesoraca16@gmail.com/ [2] https://github.com/KSPP/linux/issues/14 Cc: Salvatore Mesoraca <s.mesoraca16@gmail.com> Cc: x86@kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-doc@vger.kernel.org Cc: linux-kbuild@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
23 lines
579 B
Plaintext
23 lines
579 B
Plaintext
# Basic kernel hardening options (specific to arm64)
|
|
|
|
# Make sure PAN emulation is enabled.
|
|
CONFIG_ARM64_SW_TTBR0_PAN=y
|
|
|
|
# Software Shadow Stack or PAC
|
|
CONFIG_SHADOW_CALL_STACK=y
|
|
|
|
# Pointer authentication (ARMv8.3 and later). If hardware actually supports
|
|
# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
|
|
CONFIG_ARM64_PTR_AUTH=y
|
|
CONFIG_ARM64_PTR_AUTH_KERNEL=y
|
|
|
|
# Available in ARMv8.5 and later.
|
|
CONFIG_ARM64_BTI=y
|
|
CONFIG_ARM64_BTI_KERNEL=y
|
|
CONFIG_ARM64_MTE=y
|
|
CONFIG_KASAN_HW_TAGS=y
|
|
CONFIG_ARM64_E0PD=y
|
|
|
|
# Available in ARMv8.7 and later.
|
|
CONFIG_ARM64_EPAN=y
|