From patchwork Wed Apr 10 16:16:09 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10894329 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 16720186D for ; Wed, 10 Apr 2019 16:16:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0756828CE5 for ; Wed, 10 Apr 2019 16:16:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0544328CF0; Wed, 10 Apr 2019 16:16:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BA2C328D0C for ; Wed, 10 Apr 2019 16:16:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387711AbfDJQQh (ORCPT ); Wed, 10 Apr 2019 12:16:37 -0400 Received: from mail-pg1-f193.google.com ([209.85.215.193]:36606 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387703AbfDJQQU (ORCPT ); Wed, 10 Apr 2019 12:16:20 -0400 Received: by mail-pg1-f193.google.com with SMTP id 85so1851127pgc.3 for ; Wed, 10 Apr 2019 09:16:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id; bh=x2KYJib3dOzOX8W30eA/GdsrFGJ1QDL/O1I+P3kYlwg=; b=XpXvL2K4TmeTB6apty/+7j6PaDGjBWukrD4XgOwH9jLi+UosDmIFjrCJSyhUPwI24r t9Qz8BPGmRFt3uOj8lrdM/YocFw48FOg9wQe5zN745/WR4lqDEAOREOVv818ht6yOHhw oaMsZGMubKVo6KkCHERJnTkhBjwwymhVBTj/g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=x2KYJib3dOzOX8W30eA/GdsrFGJ1QDL/O1I+P3kYlwg=; b=U4xUAsPKNzHmbfPJdpaM4RJb2A6ESCZKTy2kBIaA1LDIH8prhfXnMyPFRWZC3R6ovU Lq9HZtr2iUrzZn4xffRF6fjxc4xh+8L4wdODtiG3Y+RvWdHCwz/VmYWh48kAc6pRkXrG lQ+FT4cOmZMQA86Dk4LVX7VN1H07wKw3Ga98/71H/rn3JV4XPCzP1ZCmO8FuEVaRf5Y0 numf0AHLGIUcVP1nu6t8+RrTmiqQI1fBXdtNHuDj05OrmHS3XgcM9Q9ihBQ5jACbovh1 fUu/nRf09wsR67EnyoW+nwlyn/nZGVQ8A8SEcCwFt/7TlU+ahvf/Sa5O57NtFaW8QO2E /jAA== X-Gm-Message-State: APjAAAU8veV0zkL6pbxhniOsvcmkCxExwcu+FDT+NDpeAmcGKCZ9x4L6 yTjfuz5R94TK8w07t3UMWEToQw== X-Google-Smtp-Source: APXvYqxV7u4z3SP7rQZaoXm6DgmvlM21aDP/eOO6IxVz6Xq3ILyC5OTxhjHS1EiCzLNEbjzmkf0D4Q== X-Received: by 2002:a65:6389:: with SMTP id h9mr42126678pgv.398.1554912979563; Wed, 10 Apr 2019 09:16:19 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id a12sm41025812pgq.21.2019.04.10.09.16.17 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 10 Apr 2019 09:16:18 -0700 (PDT) From: Kees Cook To: Masahiro Yamada Cc: Kees Cook , Alexander Potapenko , Nick Desaulniers , Kostya Serebryany , Dmitry Vyukov , Sandeep Patil , Laura Abbott , Randy Dunlap , Alexander Popov , Michal Marek , Emese Revfy , James Morris , "Serge E. Hallyn" , linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH 0/3] Kconfig: Refactor memory initialization hardening Date: Wed, 10 Apr 2019 09:16:09 -0700 Message-Id: <20190410161612.18545-1-keescook@chromium.org> X-Mailer: git-send-email 2.17.1 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This is a proposed alternative for the memory initialization series, which refactoring the existing gcc plugins into a separate Kconfig file and collects all the related options together with some more language to describe their differences. The last patch adds the Clang auto init option, as done by Alexander Potapenko. Since there isn't really a good way to "select" with dependencies, I've left out CONFIG_INIT_ALL_MEMORY for the moment... -Kees Kees Cook (3): Kconfig: Create "kernel hardening" config area kbuild: Move stackleak config to Kconfig.hardening kbuild: Implement Clang's stack initialization Makefile | 5 ++ scripts/gcc-plugins/Kconfig | 121 +------------------------- security/Kconfig | 2 + security/Kconfig.hardening | 165 ++++++++++++++++++++++++++++++++++++ 4 files changed, 175 insertions(+), 118 deletions(-) create mode 100644 security/Kconfig.hardening