commit: e950ae435e3bfcc91ded4cfda5e18d5586d3168c Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun May 5 18:11:31 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun May 5 18:11:31 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e950ae43
Update to KSPP patch Bug: https://bugs.gentoo.org/930733 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 4567_distro-Gentoo-Kconfig.patch | 84 ++++++++++++++++------------------------ 1 file changed, 34 insertions(+), 50 deletions(-) diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch index 24dfb6d9..87b8fa95 100644 --- a/4567_distro-Gentoo-Kconfig.patch +++ b/4567_distro-Gentoo-Kconfig.patch @@ -1,14 +1,14 @@ ---- a/Kconfig 2022-05-11 08:37:26.685387031 -0400 -+++ b/Kconfig 2022-05-11 08:38:35.672171690 -0400 +--- a/Kconfig 2022-08-25 10:11:47.220973785 -0400 ++++ b/Kconfig 2022-08-25 10:11:56.997682513 -0400 @@ -30,3 +30,5 @@ source "lib/Kconfig" source "lib/Kconfig.debug" source "Documentation/Kconfig" + +source "distro/Kconfig" ---- /dev/null 2024-04-27 13:10:54.188000027 -0400 -+++ b/distro/Kconfig 2024-04-27 18:47:55.788589022 -0400 -@@ -0,0 +1,294 @@ +--- /dev/null 2024-05-05 10:40:37.103999988 -0400 ++++ b/distro/Kconfig 2024-05-05 13:37:37.699554927 -0400 +@@ -0,0 +1,310 @@ +menu "Gentoo Linux" + +config GENTOO_LINUX @@ -148,10 +148,6 @@ + select TIMERFD + select TMPFS_POSIX_ACL + select TMPFS_XATTR -+ select UBSAN -+ select CC_HAS_UBSAN_BOUNDS_STRICT if !CC_HAS_UBSAN_ARRAY_BOUNDS -+ select UBSAN_BOUNDS -+ select UBSAN_SHIFT + + select ANON_INODES + select BLOCK @@ -182,14 +178,14 @@ + to unmet dependencies. Search for GENTOO_KERNEL_SELF_PROTECTION_COMMON and search for + GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency information on your + specific architecture. -+ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 ++ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 + for X86_64 + +if GENTOO_KERNEL_SELF_PROTECTION +config GENTOO_KERNEL_SELF_PROTECTION_COMMON + bool "Enable Kernel Self Protection Project Recommendations" + -+ depends on GENTOO_LINUX && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !X86_X32 && !MODIFY_LDT_SYSCALL && GCC_PLUGINS && !IOMMU_DEFAULT_DMA_LAZY && !IOMMU_DEFAULT_PASSTHROUGH && IOMMU_DEFAULT_DMA_STRICT ++ depends on GENTOO_LINUX && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !X86_X32_ABI && !MODIFY_LDT_SYSCALL && GCC_PLUGINS && !IOMMU_DEFAULT_DMA_LAZY && !IOMMU_DEFAULT_PASSTHROUGH && IOMMU_DEFAULT_DMA_STRICT && SECURITY && !ARCH_EPHEMERAL_INODES && RANDSTRUCT_PERFORMANCE + + select BUG + select STRICT_KERNEL_RWX @@ -204,10 +200,14 @@ + select DEBUG_LIST + select DEBUG_SG + select HARDENED_USERCOPY if HAVE_HARDENED_USERCOPY_ALLOCATOR=y -+ select BUG_ON_DATA_CORRUPTION + select KFENCE if HAVE_ARCH_KFENCE && (!SLAB || SLUB) ++ select PAGE_TABLE_CHECK if ARCH_SUPPORTS_PAGE_TABLE_CHECK=y && EXCLUSIVE_SYSTEM_RAM=y ++ select PAGE_TABLE_CHECK_ENFORCED if PAGE_TABLE_CHECK=y + select RANDOMIZE_KSTACK_OFFSET_DEFAULT if HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET && (INIT_STACK_NONE || !CC_IS_CLANG || CLANG_VERSION>=140000) ++ select SECURITY_LANDLOCK + select SCHED_CORE if SCHED_SMT ++ select BUG_ON_DATA_CORRUPTION ++ select RANDOM_KMALLOC_CACHE if SLUB_TINY=n + select SCHED_STACK_END_CHECK + select SECCOMP if HAVE_ARCH_SECCOMP + select SECCOMP_FILTER if HAVE_ARCH_SECCOMP_FILTER @@ -216,6 +216,10 @@ + select SLAB_FREELIST_HARDENED + select SHUFFLE_PAGE_ALLOCATOR + select SLUB_DEBUG ++ select UBSAN ++ select CC_HAS_UBSAN_BOUNDS_STRICT if !CC_HAS_UBSAN_ARRAY_BOUNDS ++ select UBSAN_BOUNDS ++ select UBSAN_SHIFT + select PAGE_POISONING + select PAGE_POISONING_NO_SANITY + select PAGE_POISONING_ZERO @@ -228,7 +232,7 @@ + select GCC_PLUGIN_LATENT_ENTROPY + select GCC_PLUGIN_STRUCTLEAK + select GCC_PLUGIN_STRUCTLEAK_BYREF_ALL -+ select GCC_PLUGIN_RANDSTRUCT ++ select GCC_PLUGIN_RANDSTRUCT + select GCC_PLUGIN_RANDSTRUCT_PERFORMANCE + select ZERO_CALL_USED_REGS if CC_HAS_ZERO_CALL_USED_REGS + @@ -243,12 +247,14 @@ + depends on !X86_MSR && X86_64 && GENTOO_KERNEL_SELF_PROTECTION + default n + ++ select GCC_PLUGIN_STACKLEAK ++ select X86_KERNEL_IBT if CC_HAS_IBT=y && HAVE_OBJTOOL=y && (!LD_IS_LLD=n || LLD_VERSION>=140000) ++ select LEGACY_VSYSCALL_NONE ++ select PAGE_TABLE_ISOLATION + select RANDOMIZE_BASE + select RANDOMIZE_MEMORY + select RELOCATABLE -+ select LEGACY_VSYSCALL_NONE -+ select PAGE_TABLE_ISOLATION -+ select GCC_PLUGIN_STACKLEAK ++ select X86_USER_SHADOW_STACK if AS_WRUSS=Y + select VMAP_STACK + + @@ -258,11 +264,21 @@ + depends on ARM64 + default n + -+ select RANDOMIZE_BASE -+ select RELOCATABLE ++ select ARM64_BTI ++ select ARM64_E0PD ++ select ARM64_EPAN if ARM64_PAN=y ++ select ARM64_MTE if (ARM64_AS_HAS_MTE=y && ARM64_TAGGED_ADDR_ABI=y ) && ( AS_HAS_ARMV8_5=y ) && ( AS_HAS_LSE_ATOMICS=y ) && ( ARM64_PAN=y ) ++ select ARM64_PTR_AUTH ++ select ARM64_PTR_AUTH_KERNEL if ( ARM64_PTR_AUTH=y ) && (( CC_HAS_SIGN_RETURN_ADDRESS=y || CC_HAS_BRANCH_PROT_PAC_RET=y ) && AS_HAS_ARMV8_3=y ) && ( LD_IS_LLD=y || LD_VERSION >= 23301 || ( CC_IS_GCC=y && GCC_VERSION < 90100 )) && (CC_IS_CLANG=n || AS_HAS_CFI_NEGATE_RA_STATE=y ) && ((FUNCTION_GRAPH_TRACER=n || DYNAMIC_FTRACE_WITH_ARGS=y )) ++ select ARM64_BTI_KERNEL if ( ARM64_BTI=y ) && ( ARM64_PTR_AUTH_KERNEL=y ) && ( CC_HAS_BRANCH_PROT_PAC_RET_BTI=y ) && (CC_IS_GCC=n || GCC_VERSION >= 100100 ) && (CC_IS_GCC=n ) && ((FUNCTION_GRAPH_TRACE=n || DYNAMIC_FTRACE_WITH_ARG=y )) + select ARM64_SW_TTBR0_PAN + select CONFIG_UNMAP_KERNEL_AT_EL0 + select GCC_PLUGIN_STACKLEAK ++ select KASAN_HW_TAGS if HAVE_ARCH_KASAN_HW_TAGS=y ++ select RANDOMIZE_BASE ++ select RELOCATABLE ++ select SHADOW_CALL_STACK if ARCH_SUPPORTS_SHADOW_CALL_STACK=y && (DYNAMIC_FTRACE_WITH_ARGS=y || DYNAMIC_FTRACE_WITH_REGS=y || FUNCTION_GRAPH_TRACER=n) && MMU=y ++ select UNWIND_PATCH_PAC_INTO_SCS if (CC_IS_CLANG=y && CLANG_VERSION >= CONFIG_150000 ) && ( ARM64_PTR_AUTH_KERNEL=y && CC_HAS_BRANCH_PROT_PAC_RET=y ) && ( SHADOW_CALL_STACK=y ) + select VMAP_STACK + +config GENTOO_KERNEL_SELF_PROTECTION_X86_32 @@ -303,37 +319,6 @@ + See the settings that become available for more details and fine-tuning. + +endmenu ---- a/security/Kconfig 2021-12-05 18:20:55.655677710 -0500 -+++ b/security/Kconfig 2021-12-05 18:23:42.404251618 -0500 -@@ -167,6 +167,7 @@ config HARDENED_USERCOPY_PAGESPAN - bool "Refuse to copy allocations that span multiple pages" - depends on HARDENED_USERCOPY - depends on EXPERT -+ depends on !GENTOO_KERNEL_SELF_PROTECTION - help - When a multi-page allocation is done without __GFP_COMP, - hardened usercopy will reject attempts to copy it. There are, -diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig -index 9e921fc72..f29bc13fa 100644 ---- a/security/selinux/Kconfig -+++ b/security/selinux/Kconfig -@@ -26,6 +26,7 @@ config SECURITY_SELINUX_BOOTPARAM - config SECURITY_SELINUX_DISABLE - bool "NSA SELinux runtime disable" - depends on SECURITY_SELINUX -+ depends on !GENTOO_KERNEL_SELF_PROTECTION - select SECURITY_WRITABLE_HOOKS - default n - help --- -2.31.1 - -From bd3ff0b16792c18c0614c2b95e148943209f460a Mon Sep 17 00:00:00 2001 -From: Georgy Yakovlev <gyakov...@gentoo.org> -Date: Tue, 8 Jun 2021 13:59:57 -0700 -Subject: [PATCH 2/2] set DEFAULT_MMAP_MIN_ADDR by default - ---- mm/Kconfig | 2 ++ 1 file changed, 2 insertions(+) @@ -352,4 +337,3 @@ index 24c045b24..e13fc740c 100644 This is the portion of low virtual memory which should be protected -- 2.31.1 -```
