diff options
author | 2024-05-05 14:13:49 -0400 | |
---|---|---|
committer | 2024-05-05 14:13:49 -0400 | |
commit | c623a513a581cbd0a45d7ea015ddb22c2e452137 (patch) | |
tree | 253a3b80b55fa1d837c4f0f730338850e90149e6 | |
parent | Linux patch 5.10.216 (diff) | |
download | linux-patches-c623a513a581cbd0a45d7ea015ddb22c2e452137.tar.gz linux-patches-c623a513a581cbd0a45d7ea015ddb22c2e452137.tar.bz2 linux-patches-c623a513a581cbd0a45d7ea015ddb22c2e452137.zip |
Update to KSPP patch
Bug: https://bugs.gentoo.org/930733
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r-- | 4567_distro-Gentoo-Kconfig.patch | 96 |
1 files changed, 38 insertions, 58 deletions
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch index 497932fe..87b8fa95 100644 --- a/4567_distro-Gentoo-Kconfig.patch +++ b/4567_distro-Gentoo-Kconfig.patch @@ -1,14 +1,14 @@ ---- a/Kconfig 2021-06-04 19:03:33.646823432 -0400 -+++ b/Kconfig 2021-06-04 19:03:40.508892817 -0400 +--- a/Kconfig 2022-08-25 10:11:47.220973785 -0400 ++++ b/Kconfig 2022-08-25 10:11:56.997682513 -0400 @@ -30,3 +30,5 @@ source "lib/Kconfig" source "lib/Kconfig.debug" source "Documentation/Kconfig" + +source "distro/Kconfig" ---- /dev/null 2024-04-27 13:10:54.188000027 -0400 -+++ b/distro/Kconfig 2024-04-27 18:54:09.734564235 -0400 -@@ -0,0 +1,289 @@ +--- /dev/null 2024-05-05 10:40:37.103999988 -0400 ++++ b/distro/Kconfig 2024-05-05 13:37:37.699554927 -0400 +@@ -0,0 +1,310 @@ +menu "Gentoo Linux" + +config GENTOO_LINUX @@ -148,10 +148,6 @@ + select TIMERFD + select TMPFS_POSIX_ACL + select TMPFS_XATTR -+ select UBSAN -+ select CC_HAS_UBSAN_BOUNDS_STRICT if !CC_HAS_UBSAN_ARRAY_BOUNDS -+ select UBSAN_BOUNDS -+ select UBSAN_SHIFT + + select ANON_INODES + select BLOCK @@ -182,14 +178,14 @@ + to unmet dependencies. Search for GENTOO_KERNEL_SELF_PROTECTION_COMMON and search for + GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency information on your + specific architecture. -+ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 ++ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 + for X86_64 + +if GENTOO_KERNEL_SELF_PROTECTION +config GENTOO_KERNEL_SELF_PROTECTION_COMMON + bool "Enable Kernel Self Protection Project Recommendations" + -+ depends on GENTOO_LINUX && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !DEVKMEM && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !X86_X32 && !MODIFY_LDT_SYSCALL && GCC_PLUGINS ++ depends on GENTOO_LINUX && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !X86_X32_ABI && !MODIFY_LDT_SYSCALL && GCC_PLUGINS && !IOMMU_DEFAULT_DMA_LAZY && !IOMMU_DEFAULT_PASSTHROUGH && IOMMU_DEFAULT_DMA_STRICT && SECURITY && !ARCH_EPHEMERAL_INODES && RANDSTRUCT_PERFORMANCE + + select BUG + select STRICT_KERNEL_RWX @@ -203,7 +199,15 @@ + select DEBUG_NOTIFIERS + select DEBUG_LIST + select DEBUG_SG ++ select HARDENED_USERCOPY if HAVE_HARDENED_USERCOPY_ALLOCATOR=y ++ select KFENCE if HAVE_ARCH_KFENCE && (!SLAB || SLUB) ++ select PAGE_TABLE_CHECK if ARCH_SUPPORTS_PAGE_TABLE_CHECK=y && EXCLUSIVE_SYSTEM_RAM=y ++ select PAGE_TABLE_CHECK_ENFORCED if PAGE_TABLE_CHECK=y ++ select RANDOMIZE_KSTACK_OFFSET_DEFAULT if HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET && (INIT_STACK_NONE || !CC_IS_CLANG || CLANG_VERSION>=140000) ++ select SECURITY_LANDLOCK ++ select SCHED_CORE if SCHED_SMT + select BUG_ON_DATA_CORRUPTION ++ select RANDOM_KMALLOC_CACHE if SLUB_TINY=n + select SCHED_STACK_END_CHECK + select SECCOMP if HAVE_ARCH_SECCOMP + select SECCOMP_FILTER if HAVE_ARCH_SECCOMP_FILTER @@ -212,6 +216,10 @@ + select SLAB_FREELIST_HARDENED + select SHUFFLE_PAGE_ALLOCATOR + select SLUB_DEBUG ++ select UBSAN ++ select CC_HAS_UBSAN_BOUNDS_STRICT if !CC_HAS_UBSAN_ARRAY_BOUNDS ++ select UBSAN_BOUNDS ++ select UBSAN_SHIFT + select PAGE_POISONING + select PAGE_POISONING_NO_SANITY + select PAGE_POISONING_ZERO @@ -224,8 +232,9 @@ + select GCC_PLUGIN_LATENT_ENTROPY + select GCC_PLUGIN_STRUCTLEAK + select GCC_PLUGIN_STRUCTLEAK_BYREF_ALL -+ select GCC_PLUGIN_RANDSTRUCT ++ select GCC_PLUGIN_RANDSTRUCT + select GCC_PLUGIN_RANDSTRUCT_PERFORMANCE ++ select ZERO_CALL_USED_REGS if CC_HAS_ZERO_CALL_USED_REGS + + help + Search for GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency @@ -238,12 +247,14 @@ + depends on !X86_MSR && X86_64 && GENTOO_KERNEL_SELF_PROTECTION + default n + ++ select GCC_PLUGIN_STACKLEAK ++ select X86_KERNEL_IBT if CC_HAS_IBT=y && HAVE_OBJTOOL=y && (!LD_IS_LLD=n || LLD_VERSION>=140000) ++ select LEGACY_VSYSCALL_NONE ++ select PAGE_TABLE_ISOLATION + select RANDOMIZE_BASE + select RANDOMIZE_MEMORY + select RELOCATABLE -+ select LEGACY_VSYSCALL_NONE -+ select PAGE_TABLE_ISOLATION -+ select GCC_PLUGIN_STACKLEAK ++ select X86_USER_SHADOW_STACK if AS_WRUSS=Y + select VMAP_STACK + + @@ -253,11 +264,21 @@ + depends on ARM64 + default n + -+ select RANDOMIZE_BASE -+ select RELOCATABLE ++ select ARM64_BTI ++ select ARM64_E0PD ++ select ARM64_EPAN if ARM64_PAN=y ++ select ARM64_MTE if (ARM64_AS_HAS_MTE=y && ARM64_TAGGED_ADDR_ABI=y ) && ( AS_HAS_ARMV8_5=y ) && ( AS_HAS_LSE_ATOMICS=y ) && ( ARM64_PAN=y ) ++ select ARM64_PTR_AUTH ++ select ARM64_PTR_AUTH_KERNEL if ( ARM64_PTR_AUTH=y ) && (( CC_HAS_SIGN_RETURN_ADDRESS=y || CC_HAS_BRANCH_PROT_PAC_RET=y ) && AS_HAS_ARMV8_3=y ) && ( LD_IS_LLD=y || LD_VERSION >= 23301 || ( CC_IS_GCC=y && GCC_VERSION < 90100 )) && (CC_IS_CLANG=n || AS_HAS_CFI_NEGATE_RA_STATE=y ) && ((FUNCTION_GRAPH_TRACER=n || DYNAMIC_FTRACE_WITH_ARGS=y )) ++ select ARM64_BTI_KERNEL if ( ARM64_BTI=y ) && ( ARM64_PTR_AUTH_KERNEL=y ) && ( CC_HAS_BRANCH_PROT_PAC_RET_BTI=y ) && (CC_IS_GCC=n || GCC_VERSION >= 100100 ) && (CC_IS_GCC=n ) && ((FUNCTION_GRAPH_TRACE=n || DYNAMIC_FTRACE_WITH_ARG=y )) + select ARM64_SW_TTBR0_PAN + select CONFIG_UNMAP_KERNEL_AT_EL0 + select GCC_PLUGIN_STACKLEAK ++ select KASAN_HW_TAGS if HAVE_ARCH_KASAN_HW_TAGS=y ++ select RANDOMIZE_BASE ++ select RELOCATABLE ++ select SHADOW_CALL_STACK if ARCH_SUPPORTS_SHADOW_CALL_STACK=y && (DYNAMIC_FTRACE_WITH_ARGS=y || DYNAMIC_FTRACE_WITH_REGS=y || FUNCTION_GRAPH_TRACER=n) && MMU=y ++ select UNWIND_PATCH_PAC_INTO_SCS if (CC_IS_CLANG=y && CLANG_VERSION >= CONFIG_150000 ) && ( ARM64_PTR_AUTH_KERNEL=y && CC_HAS_BRANCH_PROT_PAC_RET=y ) && ( SHADOW_CALL_STACK=y ) + select VMAP_STACK + +config GENTOO_KERNEL_SELF_PROTECTION_X86_32 @@ -298,47 +319,6 @@ + See the settings that become available for more details and fine-tuning. + +endmenu -diff --git a/security/Kconfig b/security/Kconfig -index 7561f6f99..01f0bf73f 100644 ---- a/security/Kconfig -+++ b/security/Kconfig -@@ -166,6 +166,7 @@ config HARDENED_USERCOPY - config HARDENED_USERCOPY_FALLBACK - bool "Allow usercopy whitelist violations to fallback to object size" - depends on HARDENED_USERCOPY -+ depends on !GENTOO_KERNEL_SELF_PROTECTION - default y - help - This is a temporary option that allows missing usercopy whitelists -@@ -181,6 +182,7 @@ config HARDENED_USERCOPY_PAGESPAN - bool "Refuse to copy allocations that span multiple pages" - depends on HARDENED_USERCOPY - depends on EXPERT -+ depends on !GENTOO_KERNEL_SELF_PROTECTION - help - When a multi-page allocation is done without __GFP_COMP, - hardened usercopy will reject attempts to copy it. There are, -diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig -index 9e921fc72..f29bc13fa 100644 ---- a/security/selinux/Kconfig -+++ b/security/selinux/Kconfig -@@ -26,6 +26,7 @@ config SECURITY_SELINUX_BOOTPARAM - config SECURITY_SELINUX_DISABLE - bool "NSA SELinux runtime disable" - depends on SECURITY_SELINUX -+ depends on !GENTOO_KERNEL_SELF_PROTECTION - select SECURITY_WRITABLE_HOOKS - default n - help --- -2.31.1 - -From bd3ff0b16792c18c0614c2b95e148943209f460a Mon Sep 17 00:00:00 2001 -From: Georgy Yakovlev <gyakovlev@gentoo.org> -Date: Tue, 8 Jun 2021 13:59:57 -0700 -Subject: [PATCH 2/2] set DEFAULT_MMAP_MIN_ADDR by default - ---- mm/Kconfig | 2 ++ 1 file changed, 2 insertions(+) |