[PATCH 7/8] configs/hardening: Enable CONFIG_STACKLEAK
From: Kees Cook <kees@kernel.org>
Date: 2025-05-07 18:16:21
Also in:
kvmarm, linux-arm-kernel, linux-doc, linux-efi, linux-hardening, linux-kbuild, linux-kselftest, linux-riscv, linux-s390, lkml, llvm, sparclinux
Subsystem:
kernel hardening (not covered by other areas), the rest · Maintainers:
Kees Cook, Linus Torvalds
Since we can wipe the stack with both Clang and GCC plugins, enable this for the "hardening.config" for wider testing. Signed-off-by: Kees Cook <kees@kernel.org> --- Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: <redacted> --- kernel/configs/hardening.config | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index dd7c32fb5ac1..3da00926b4eb 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config@@ -63,6 +63,9 @@ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y # Initialize all stack variables to zero on function entry. CONFIG_INIT_STACK_ALL_ZERO=y +# Wipe kernel stack after syscall completion to reduce stale data lifetime. +CONFIG_STACKLEAK=y + # Wipe RAM at reboot via EFI. For more details, see: # https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/ # https://bugzilla.redhat.com/show_bug.cgi?id=1532058
--
2.34.1