harden default options of Kconfig#32

Open

theLOICofFRANCE wants to merge 103 commits into

anthraxx:masterfrom

theLOICofFRANCE:Kconfig

Commits on Feb 5, 2020

make DEFAULT_MMAP_MIN_ADDR match LSM_MMAP_MIN_ADDR

thestinger
authored and
anthraxx
committed
enable HARDENED_USERCOPY by default

thestinger
authored and
anthraxx
committed
disable HARDENED_USERCOPY_FALLBACK by default

thestinger
authored and
anthraxx
committed
enable SECURITY_DMESG_RESTRICT by default

thestinger
authored and
anthraxx
committed
set kptr_restrict=2 by default

thestinger
authored and
anthraxx
committed
enable DEBUG_LIST by default

thestinger
authored and
anthraxx
committed
enable BUG_ON_DATA_CORRUPTION by default

thestinger
authored and
anthraxx
committed
enable ARM64_SW_TTBR0_PAN by default

thestinger
authored and
anthraxx
committed
arm64: enable RANDOMIZE_BASE by default

thestinger
authored and
anthraxx
committed
enable SLAB_FREELIST_RANDOM by default

thestinger
authored and
anthraxx
committed
enable SLAB_FREELIST_HARDENED by default

thestinger
authored and
anthraxx
committed
disable SLAB_MERGE_DEFAULT by default

thestinger
authored and
anthraxx
committed
enable FORTIFY_SOURCE by default

thestinger
authored and
anthraxx
committed
enable PANIC_ON_OOPS by default

thestinger
authored and
anthraxx
committed
stop hiding SLUB_DEBUG behind EXPERT

thestinger
authored and
anthraxx
committed
stop hiding X86_16BIT behind EXPERT

thestinger
authored and
anthraxx
committed
disable X86_16BIT by default

thestinger
authored and
anthraxx
committed
stop hiding MODIFY_LDT_SYSCALL behind EXPERT

thestinger
authored and
anthraxx
committed
disable MODIFY_LDT_SYSCALL by default

thestinger
authored and
anthraxx
committed
set LEGACY_VSYSCALL_NONE by default

thestinger
authored and
anthraxx
committed
stop hiding AIO behind EXPERT

Bernhard40
authored and
anthraxx
committed
disable AIO by default

Bernhard40
authored and
anthraxx
committed
remove SYSVIPC from arm64/x86_64 defconfigs

thestinger
authored and
anthraxx
committed
disable DEVPORT by default

thestinger
authored and
anthraxx
committed
disable PROC_VMCORE by default

thestinger
authored and
anthraxx
committed
disable NFS_DEBUG by default

thestinger
authored and
anthraxx
committed
enable DEBUG_WX by default

thestinger
authored and
anthraxx
committed
disable LEGACY_PTYS by default

thestinger
authored and
anthraxx
committed
disable DEVMEM by default

thestinger
authored and
anthraxx
committed
enable IO_STRICT_DEVMEM by default

thestinger
authored and
anthraxx
committed
disable COMPAT_BRK by default

thestinger
authored and
anthraxx
committed
use maximum supported mmap rnd entropy by default

thestinger
authored and
anthraxx
committed
enable protected_{symlinks,hardlinks} by default

thestinger
authored and
anthraxx
committed
enable SECURITY by default

thestinger
authored and
anthraxx
committed
enable SECURITY_YAMA by default

thestinger
authored and
anthraxx
committed
enable SECURITY_NETWORK by default

thestinger
authored and
anthraxx
committed
enable AUDIT by default

thestinger
authored and
anthraxx
committed
enable SECURITY_SELINUX by default

thestinger
authored and
anthraxx
committed
enable SYN_COOKIES by default

thestinger
authored and
anthraxx
committed
add __read_only for non-init related usage

thestinger
authored and
anthraxx
committed
make sysctl constants read-only

thestinger
authored and
anthraxx
committed
mark kernel_set_to_readonly as __ro_after_init

thestinger
authored and
anthraxx
committed
mark slub runtime configuration as __ro_after_init

thestinger
authored and
anthraxx
committed
add __ro_after_init to slab_nomerge and slab_state

thestinger
authored and
anthraxx
committed
mark kmem_cache as __ro_after_init

thestinger
authored and
anthraxx
committed
mark __supported_pte_mask as __ro_after_init

thestinger
authored and
anthraxx
committed
mark kobj_ns_type_register as only used for init

thestinger
authored and
anthraxx
committed
mark open_softirq as only used for init

thestinger
authored and
anthraxx
committed
remove unused softirq_action callback parameter

thestinger
authored and
anthraxx
committed
mark softirq_vec as __ro_after_init

thestinger
authored and
anthraxx
committed
mm: slab: trigger BUG if requested object is not a slab page

thestinger
authored and
anthraxx
committed
bug on kmem_cache_free with the wrong cache

thestinger
authored and
anthraxx
committed
bug on !PageSlab && !PageCompound in ksize

thestinger
authored and
anthraxx
committed
mm: add support for verifying page sanitization

thestinger
authored and
anthraxx
committed
slub: Extend init_on_free to slab caches with constructors

tsautereau-anssi
authored and
anthraxx
committed
slub: Add support for verifying slab sanitization

thestinger
authored and
anthraxx
committed
slub: add multi-purpose random canaries

thestinger
authored and
anthraxx
committed
security,perf: Allow further restriction of perf_event_open

bwhacks
authored and
anthraxx
committed
enable SECURITY_PERF_EVENTS_RESTRICT by default

thestinger
authored and
anthraxx
committed
add sysctl to disallow unprivileged CLONE_NEWUSER by default

hallyn
authored and
anthraxx
committed
add kmalloc/krealloc alloc_size attributes

thestinger
authored and
anthraxx
committed
add vmalloc alloc_size attributes

thestinger
authored and
anthraxx
committed
add kvmalloc alloc_size attribute

thestinger
authored and
anthraxx
committed
add percpu alloc_size attributes

thestinger
authored and
anthraxx
committed
add alloc_pages_exact alloc_size attributes

thestinger
authored and
anthraxx
committed
Add the extra_latent_entropy kernel parameter

ephox-gcc-plugins
authored and
anthraxx
committed
ata: avoid null pointer dereference on bug

thestinger
authored and
anthraxx
committed
sanity check for negative length in nla_memcpy

thestinger
authored and
anthraxx
committed
add page destructor sanity check

thestinger
authored and
anthraxx
committed
PaX shadow cr4 sanity check (essentially a revert)

thestinger
authored and
anthraxx
committed
add writable function pointer detection

thestinger
authored and
anthraxx
committed
support overriding early audit kernel cmdline

thestinger
authored and
anthraxx
committed
FORTIFY_SOURCE intra-object overflow checking

thestinger
authored and
anthraxx
committed
Revert "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes"

thestinger
authored and
anthraxx
committed
x86_64: move vdso to mmap region from stack region

thestinger
authored and
anthraxx
committed
x86: determine stack entropy based on mmap entropy

thestinger
authored and
anthraxx
committed
arm64: determine stack entropy based on mmap entropy

thestinger
authored and
anthraxx
committed
randomize lower bits of the argument block

thestinger
authored and
anthraxx
committed
x86_64: match arm64 brk randomization entropy

thestinger
authored and
anthraxx
committed
support randomizing the lower bits of brk

thestinger
authored and
anthraxx
committed
mm: randomize lower bits of brk

thestinger
authored and
anthraxx
committed
x86: randomize lower bits of brk

thestinger
authored and
anthraxx
committed
mm: guarantee brk gap is at least one page

thestinger
authored and
anthraxx
committed
x86: guarantee brk gap is at least one page

thestinger
authored and
anthraxx
committed
x86_64: bound mmap between legacy/modern bases

thestinger
authored and
anthraxx
committed
restrict device timing side channels

thestinger
authored and
anthraxx
committed
add toggle for disabling newly added USB devices

thestinger
authored and
anthraxx
committed
hard-wire legacy checkreqprot option to 0

thestinger
authored and
anthraxx
committed
security: tty: Add owner user namespace to tty_struct

nmatt0
authored and
anthraxx
committed
security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

nmatt0
authored and
anthraxx
committed
enable SECURITY_TIOCSTI_RESTRICT by default

thestinger
authored and
anthraxx
committed
disable unprivileged eBPF access by default
anthraxx
committed
enable BPF JIT hardening by default (if available)
anthraxx
committed
enable protected_{fifos,regular} by default
anthraxx
committed
Revert "mark kernel_set_to_readonly as __ro_after_init"
anthraxx
committed
modpost: Add CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE

tsautereau-anssi
authored and
anthraxx
committed
mm: Fix extra_latent_entropy

tsautereau-anssi
authored and
anthraxx
committed
add CONFIG for unprivileged_userns_clone
anthraxx
committed
enable INIT_ON_ALLOC_DEFAULT_ON by default
anthraxx
committed
enable INIT_ON_FREE_DEFAULT_ON by default
anthraxx
committed
add CONFIG for unprivileged_userfaultfd
anthraxx
committed
slub: Extend init_on_alloc to slab caches with constructors

tsautereau-anssi
authored and
anthraxx
committed

Commits on Mar 31, 2020

harden default options of Kconfig
theLOICofFRANCE
committed