From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 01:50:20
The QLGE driver moved to staging in commit 955315b0dc8c ("qlge: Move
drivers/net/ethernet/qlogic/qlge/ to drivers/staging/qlge/"), meaning
our defconfigs that enable it have no effect as we don't enable
CONFIG_STAGING.
It sounds like the device is obsolete, so drop the driver.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/powernv_defconfig | 1 -
arch/powerpc/configs/ppc64_defconfig | 1 -
arch/powerpc/configs/ppc6xx_defconfig | 1 -
arch/powerpc/configs/pseries_defconfig | 1 -
arch/powerpc/configs/skiroot_defconfig | 1 -
5 files changed, 5 deletions(-)
@@ -181,7 +181,6 @@ CONFIG_MLX5_FPGA=y CONFIG_MLX5_CORE_EN=y CONFIG_MLX5_CORE_IPOIB=y CONFIG_MYRI10GE=m-CONFIG_QLGE=m CONFIG_NETXEN_NIC=m CONFIG_USB_NET_DRIVERS=m # CONFIG_WLAN is not set
@@ -171,7 +171,6 @@ CONFIG_MYRI10GE=m # CONFIG_NET_VENDOR_NVIDIA is not set # CONFIG_NET_VENDOR_OKI is not set # CONFIG_NET_VENDOR_PACKET_ENGINES is not set-CONFIG_QLGE=m CONFIG_NETXEN_NIC=m CONFIG_QED=m CONFIG_QEDE=m
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 01:52:25
The NET_CADENCE symbol was renamed to NET_VENDOR_CADENCE, so we don't
need to disable the former, see commit 0df5f81c481e ("net: ethernet:
Add missing VENDOR to Cadence and Packet Engines symbols").
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 1 -
1 file changed, 1 deletion(-)
@@ -138,7 +138,6 @@ CONFIG_TIGON3=m CONFIG_BNX2X=m # CONFIG_NET_VENDOR_BROCADE is not set # CONFIG_NET_VENDOR_CADENCE is not set-# CONFIG_NET_CADENCE is not set # CONFIG_NET_VENDOR_CAVIUM is not set CONFIG_CHELSIO_T1=m # CONFIG_NET_VENDOR_CISCO is not set
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 01:54:18
Commit bdd08fff4915 ("HID: logitech: Add depends on LEDS_CLASS to
Logitech Kconfig entry") made HID_LOGITECH depend on LEDS_CLASS which
we do not enable, meaning we are not actually enabling those drivers
any more.
The Kconfig help text suggests USB HID compliant Logictech devices
will continue to work without HID_LOGITECH, so just drop it.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 1 -
1 file changed, 1 deletion(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 01:56:15
The HP network driver moved to staging in commit 52340b82cf1a ("hp100:
Move 100BaseVG AnyLAN driver to staging") meaning we don't need to
disable it any more in our defconfigs.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/44x/akebono_defconfig | 1 -
arch/powerpc/configs/skiroot_defconfig | 1 -
2 files changed, 2 deletions(-)
@@ -59,7 +59,6 @@ CONFIG_BLK_DEV_SD=y # CONFIG_NET_VENDOR_DLINK is not set # CONFIG_NET_VENDOR_EMULEX is not set # CONFIG_NET_VENDOR_EXAR is not set-# CONFIG_NET_VENDOR_HP is not set CONFIG_IBM_EMAC=y # CONFIG_NET_VENDOR_MARVELL is not set # CONFIG_NET_VENDOR_MELLANOX is not set
@@ -146,7 +146,6 @@ CONFIG_CHELSIO_T1=m # CONFIG_NET_VENDOR_DLINK is not set CONFIG_BE2NET=m # CONFIG_NET_VENDOR_EZCHIP is not set-# CONFIG_NET_VENDOR_HP is not set # CONFIG_NET_VENDOR_HUAWEI is not set CONFIG_E1000=m CONFIG_E1000E=m
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 01:58:09
It's default n so we don't need to disable it.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 1 -
1 file changed, 1 deletion(-)
@@ -293,5 +293,4 @@ CONFIG_WQ_WATCHDOG=y CONFIG_XMON=y CONFIG_XMON_DEFAULT=y CONFIG_ENCRYPTED_KEYS=y-# CONFIG_CRYPTO_ECHAINIV is not set # CONFIG_CRYPTO_HW is not set
@@ -1,8 +1,3 @@-CONFIG_PPC64=y-CONFIG_ALTIVEC=y-CONFIG_VSX=y-CONFIG_NR_CPUS=2048-CONFIG_CPU_LITTLE_ENDIAN=y CONFIG_KERNEL_XZ=y # CONFIG_SWAP is not set CONFIG_SYSVIPC=y
@@ -29,16 +24,11 @@ CONFIG_EXPERT=y CONFIG_PERF_EVENTS=y # CONFIG_COMPAT_BRK is not set CONFIG_SLAB_FREELIST_HARDENED=y-CONFIG_JUMP_LABEL=y-CONFIG_STRICT_KERNEL_RWX=y-CONFIG_MODULES=y-CONFIG_MODULE_UNLOAD=y-CONFIG_MODULE_SIG=y-CONFIG_MODULE_SIG_FORCE=y-CONFIG_MODULE_SIG_SHA512=y-CONFIG_PARTITION_ADVANCED=y-# CONFIG_MQ_IOSCHED_DEADLINE is not set-# CONFIG_MQ_IOSCHED_KYBER is not set+CONFIG_PPC64=y+CONFIG_ALTIVEC=y+CONFIG_VSX=y+CONFIG_NR_CPUS=2048+CONFIG_CPU_LITTLE_ENDIAN=y # CONFIG_PPC_VAS is not set # CONFIG_PPC_PSERIES is not set # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
@@ -49,14 +39,24 @@ CONFIG_KEXEC=y CONFIG_PRESERVE_FA_DUMP=y CONFIG_IRQ_ALL_CPUS=y CONFIG_NUMA=y-# CONFIG_COMPACTION is not set-# CONFIG_MIGRATION is not set CONFIG_PPC_64K_PAGES=y CONFIG_SCHED_SMT=y CONFIG_CMDLINE_BOOL=y CONFIG_CMDLINE="console=tty0 console=hvc0 ipr.fast_reboot=1 quiet" # CONFIG_SECCOMP is not set # CONFIG_PPC_MEM_KEYS is not set+CONFIG_JUMP_LABEL=y+CONFIG_STRICT_KERNEL_RWX=y+CONFIG_MODULES=y+CONFIG_MODULE_UNLOAD=y+CONFIG_MODULE_SIG=y+CONFIG_MODULE_SIG_FORCE=y+CONFIG_MODULE_SIG_SHA512=y+CONFIG_PARTITION_ADVANCED=y+# CONFIG_MQ_IOSCHED_DEADLINE is not set+# CONFIG_MQ_IOSCHED_KYBER is not set+# CONFIG_COMPACTION is not set+# CONFIG_MIGRATION is not set CONFIG_NET=y CONFIG_PACKET=y CONFIG_UNIX=y
@@ -153,7 +153,6 @@ CONFIG_IGB=m CONFIG_IXGB=m CONFIG_IXGBE=m CONFIG_I40E=m-CONFIG_S2IO=m # CONFIG_NET_VENDOR_MARVELL is not set CONFIG_MLX4_EN=m # CONFIG_MLX4_CORE_GEN2 is not set
@@ -164,6 +163,7 @@ CONFIG_MLX5_CORE_EN=y # CONFIG_NET_VENDOR_MICROSEMI is not set CONFIG_MYRI10GE=m # CONFIG_NET_VENDOR_NATSEMI is not set+CONFIG_S2IO=m # CONFIG_NET_VENDOR_NETRONOME is not set # CONFIG_NET_VENDOR_NI is not set # CONFIG_NET_VENDOR_NVIDIA is not set
@@ -271,6 +271,8 @@ CONFIG_NLS_CODEPAGE_437=y CONFIG_NLS_ASCII=y CONFIG_NLS_ISO8859_1=y CONFIG_NLS_UTF8=y+CONFIG_ENCRYPTED_KEYS=y+# CONFIG_CRYPTO_HW is not set CONFIG_CRC16=y CONFIG_CRC_ITU_T=y CONFIG_LIBCRC32C=y
@@ -289,8 +291,6 @@ CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y CONFIG_WQ_WATCHDOG=y # CONFIG_SCHED_DEBUG is not set # CONFIG_FTRACE is not set-# CONFIG_RUNTIME_TESTING_MENU is not set CONFIG_XMON=y CONFIG_XMON_DEFAULT=y-CONFIG_ENCRYPTED_KEYS=y-# CONFIG_CRYPTO_HW is not set+# CONFIG_RUNTIME_TESTING_MENU is not set
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 02:02:07
From: Joel Stanley <joel@jms.id.au>
This turns on HARDENED_USERCOPY with HARDENED_USERCOPY_PAGESPAN, and
FORTIFY_SOURCE.
It also enables SECURITY_LOCKDOWN_LSM with _EARLY and
LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY options enabled.
MODULE_SIG is selected by lockdown, so it is still enabled.
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
@@ -272,6 +271,16 @@ CONFIG_NLS_ASCII=y CONFIG_NLS_ISO8859_1=y CONFIG_NLS_UTF8=y CONFIG_ENCRYPTED_KEYS=y+CONFIG_SECURITY=y+CONFIG_HARDENED_USERCOPY=y+# CONFIG_HARDENED_USERCOPY_FALLBACK is not set+CONFIG_HARDENED_USERCOPY_PAGESPAN=y+CONFIG_FORTIFY_SOURCE=y+CONFIG_SECURITY_LOCKDOWN_LSM=y+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y+CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y+# CONFIG_INTEGRITY is not set+CONFIG_LSM="yama,loadpin,safesetid,integrity" # CONFIG_CRYPTO_HW is not set CONFIG_CRC16=y CONFIG_CRC_ITU_T=y
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 02:03:56
If the skiroot kernel crashes we don't want it sitting at an xmon
prompt forever. Instead it's more helpful to reboot and bring the
boot loader back up, and if the crash was transient we can then boot
successfully.
Similarly if we panic we should reboot, with a short timeout in case
someone is watching the console.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
@@ -29,6 +29,7 @@ CONFIG_ALTIVEC=y CONFIG_VSX=y CONFIG_NR_CPUS=2048 CONFIG_CPU_LITTLE_ENDIAN=y+CONFIG_PANIC_TIMEOUT=30 # CONFIG_PPC_VAS is not set # CONFIG_PPC_PSERIES is not set # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
@@ -301,5 +303,4 @@ CONFIG_WQ_WATCHDOG=y # CONFIG_SCHED_DEBUG is not set # CONFIG_FTRACE is not set CONFIG_XMON=y-CONFIG_XMON_DEFAULT=y # CONFIG_RUNTIME_TESTING_MENU is not set
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-16 02:06:02
Enable more hardening options.
Note BUG_ON_DATA_CORRUPTION selects DEBUG_LIST and is essentially just
a synonym for it.
DEBUG_SG, DEBUG_NOTIFIERS, DEBUG_LIST, DEBUG_CREDENTIALS and
SCHED_STACK_END_CHECK should all be low overhead and just add a few
extra checks.
Unselecting SLAB_MERGE_DEFAULT causes the SLAB to use more memory, but
the skiroot kernel shouldn't be memory constrained on any of our
systems, all it does is run a small bootloader.
SLAB_FREELIST_RANDOM, and SLUB_DEBUG_ON will add some overhead to the
SLAB allocator, but nothing that should be meaningful for skiroot.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 8 ++++++++
1 file changed, 8 insertions(+)
@@ -23,6 +23,8 @@ CONFIG_EXPERT=y # CONFIG_AIO is not set CONFIG_PERF_EVENTS=y # CONFIG_COMPAT_BRK is not set+# CONFIG_SLAB_MERGE_DEFAULT is not set+CONFIG_SLAB_FREELIST_RANDOM=y CONFIG_SLAB_FREELIST_HARDENED=y CONFIG_PPC64=y CONFIG_ALTIVEC=y
@@ -293,6 +295,8 @@ CONFIG_LIBCRC32C=y # CONFIG_XZ_DEC_SPARC is not set CONFIG_PRINTK_TIME=y CONFIG_MAGIC_SYSRQ=y+CONFIG_SLUB_DEBUG_ON=y+CONFIG_SCHED_STACK_END_CHECK=y CONFIG_DEBUG_STACKOVERFLOW=y CONFIG_PANIC_ON_OOPS=y CONFIG_SOFTLOCKUP_DETECTOR=y
@@ -301,6 +305,10 @@ CONFIG_HARDLOCKUP_DETECTOR=y CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y CONFIG_WQ_WATCHDOG=y # CONFIG_SCHED_DEBUG is not set+CONFIG_DEBUG_SG=y+CONFIG_DEBUG_NOTIFIERS=y+CONFIG_BUG_ON_DATA_CORRUPTION=y+CONFIG_DEBUG_CREDENTIALS=y # CONFIG_FTRACE is not set CONFIG_XMON=y # CONFIG_RUNTIME_TESTING_MENU is not set
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 02:08:37
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
Enable more hardening options.
Note BUG_ON_DATA_CORRUPTION selects DEBUG_LIST and is essentially just
a synonym for it.
DEBUG_SG, DEBUG_NOTIFIERS, DEBUG_LIST, DEBUG_CREDENTIALS and
SCHED_STACK_END_CHECK should all be low overhead and just add a few
extra checks.
Unselecting SLAB_MERGE_DEFAULT causes the SLAB to use more memory, but
the skiroot kernel shouldn't be memory constrained on any of our
systems, all it does is run a small bootloader.
Why do we unselect it?
SLAB_FREELIST_RANDOM, and SLUB_DEBUG_ON will add some overhead to the
SLAB allocator, but nothing that should be meaningful for skiroot.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
@@ -23,6 +23,8 @@ CONFIG_EXPERT=y # CONFIG_AIO is not set CONFIG_PERF_EVENTS=y # CONFIG_COMPAT_BRK is not set+# CONFIG_SLAB_MERGE_DEFAULT is not set+CONFIG_SLAB_FREELIST_RANDOM=y CONFIG_SLAB_FREELIST_HARDENED=y CONFIG_PPC64=y CONFIG_ALTIVEC=y
@@ -293,6 +295,8 @@ CONFIG_LIBCRC32C=y # CONFIG_XZ_DEC_SPARC is not set CONFIG_PRINTK_TIME=y CONFIG_MAGIC_SYSRQ=y+CONFIG_SLUB_DEBUG_ON=y+CONFIG_SCHED_STACK_END_CHECK=y CONFIG_DEBUG_STACKOVERFLOW=y CONFIG_PANIC_ON_OOPS=y CONFIG_SOFTLOCKUP_DETECTOR=y
@@ -301,6 +305,10 @@ CONFIG_HARDLOCKUP_DETECTOR=y CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y CONFIG_WQ_WATCHDOG=y # CONFIG_SCHED_DEBUG is not set+CONFIG_DEBUG_SG=y+CONFIG_DEBUG_NOTIFIERS=y+CONFIG_BUG_ON_DATA_CORRUPTION=y+CONFIG_DEBUG_CREDENTIALS=y # CONFIG_FTRACE is not set CONFIG_XMON=y # CONFIG_RUNTIME_TESTING_MENU is not set--
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 02:13:06
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
If the skiroot kernel crashes we don't want it sitting at an xmon
prompt forever. Instead it's more helpful to reboot and bring the
boot loader back up, and if the crash was transient we can then boot
successfully.
Similarly if we panic we should reboot, with a short timeout in case
someone is watching the console.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
@@ -29,6 +29,7 @@ CONFIG_ALTIVEC=y CONFIG_VSX=y CONFIG_NR_CPUS=2048 CONFIG_CPU_LITTLE_ENDIAN=y+CONFIG_PANIC_TIMEOUT=30 # CONFIG_PPC_VAS is not set # CONFIG_PPC_PSERIES is not set # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
@@ -301,5 +303,4 @@ CONFIG_WQ_WATCHDOG=y # CONFIG_SCHED_DEBUG is not set # CONFIG_FTRACE is not set CONFIG_XMON=y-CONFIG_XMON_DEFAULT=y # CONFIG_RUNTIME_TESTING_MENU is not set--
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 02:15:04
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
The NET_CADENCE symbol was renamed to NET_VENDOR_CADENCE, so we don't
need to disable the former, see commit 0df5f81c481e ("net: ethernet:
Add missing VENDOR to Cadence and Packet Engines symbols").
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 02:17:48
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
The QLGE driver moved to staging in commit 955315b0dc8c ("qlge: Move
drivers/net/ethernet/qlogic/qlge/ to drivers/staging/qlge/"), meaning
our defconfigs that enable it have no effect as we don't enable
CONFIG_STAGING.
It sounds like the device is obsolete, so drop the driver.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 02:20:15
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
The HP network driver moved to staging in commit 52340b82cf1a ("hp100:
Move 100BaseVG AnyLAN driver to staging") meaning we don't need to
disable it any more in our defconfigs.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 02:22:16
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
Commit bdd08fff4915 ("HID: logitech: Add depends on LEDS_CLASS to
Logitech Kconfig entry") made HID_LOGITECH depend on LEDS_CLASS which
we do not enable, meaning we are not actually enabling those drivers
any more.
The Kconfig help text suggests USB HID compliant Logictech devices
will continue to work without HID_LOGITECH, so just drop it.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
From: Daniel Axtens <hidden> Date: 2020-01-16 05:04:51
Michael Ellerman [off-list ref] writes:
From: Joel Stanley <joel@jms.id.au>
This turns on HARDENED_USERCOPY with HARDENED_USERCOPY_PAGESPAN, and
FORTIFY_SOURCE.
It also enables SECURITY_LOCKDOWN_LSM with _EARLY and
LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY options enabled.
As I said before, this will disable xmon entirely. If we want to set
this, we should compile out xmon. But if we want xmon in read-only mode
to be an option, we should pick integrity mode.
I don't really mind, because I don't work with skiroot very
much. Oliver, Joel, Nayna, you all do stuff around this sort of level -
is this a problem for any of you?
Regards,
Daniel
quoted hunk
MODULE_SIG is selected by lockdown, so it is still enabled.
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/configs/skiroot_defconfig | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
@@ -272,6 +271,16 @@ CONFIG_NLS_ASCII=y CONFIG_NLS_ISO8859_1=y CONFIG_NLS_UTF8=y CONFIG_ENCRYPTED_KEYS=y+CONFIG_SECURITY=y+CONFIG_HARDENED_USERCOPY=y+# CONFIG_HARDENED_USERCOPY_FALLBACK is not set+CONFIG_HARDENED_USERCOPY_PAGESPAN=y+CONFIG_FORTIFY_SOURCE=y+CONFIG_SECURITY_LOCKDOWN_LSM=y+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y+CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y+# CONFIG_INTEGRITY is not set+CONFIG_LSM="yama,loadpin,safesetid,integrity" # CONFIG_CRYPTO_HW is not set CONFIG_CRC16=y CONFIG_CRC_ITU_T=y
On Thu, Jan 16, 2020 at 4:00 PM Daniel Axtens [off-list ref] wrote:
Michael Ellerman [off-list ref] writes:
quoted
From: Joel Stanley <joel@jms.id.au>
This turns on HARDENED_USERCOPY with HARDENED_USERCOPY_PAGESPAN, and
FORTIFY_SOURCE.
It also enables SECURITY_LOCKDOWN_LSM with _EARLY and
LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY options enabled.
As I said before, this will disable xmon entirely. If we want to set
this, we should compile out xmon. But if we want xmon in read-only mode
to be an option, we should pick integrity mode.
I don't really mind, because I don't work with skiroot very
much. Oliver, Joel, Nayna, you all do stuff around this sort of level -
is this a problem for any of you?
Keep it enabled and force INTEGRITY mode. There are some cases where
xmon is the only method for debugging a crashing skiroot (hello SMC
BMCs) so I'd rather it remained available. If there's some actual
security benefit to disabling it entirely then someone should
articulate that.
Oliver
From: Joel Stanley <joel@jms.id.au> Date: 2020-01-16 07:16:49
On Thu, 16 Jan 2020 at 07:10, Oliver O'Halloran [off-list ref] wrote:
On Thu, Jan 16, 2020 at 4:00 PM Daniel Axtens [off-list ref] wrote:
quoted
Michael Ellerman [off-list ref] writes:
quoted
From: Joel Stanley <joel@jms.id.au>
This turns on HARDENED_USERCOPY with HARDENED_USERCOPY_PAGESPAN, and
FORTIFY_SOURCE.
It also enables SECURITY_LOCKDOWN_LSM with _EARLY and
LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY options enabled.
As I said before, this will disable xmon entirely. If we want to set
this, we should compile out xmon. But if we want xmon in read-only mode
to be an option, we should pick integrity mode.
I don't really mind, because I don't work with skiroot very
much. Oliver, Joel, Nayna, you all do stuff around this sort of level -
is this a problem for any of you?
Keep it enabled and force INTEGRITY mode. There are some cases where
xmon is the only method for debugging a crashing skiroot (hello SMC
BMCs) so I'd rather it remained available. If there's some actual
security benefit to disabling it entirely then someone should
articulate that.
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2020-01-21 04:23:50
Joel Stanley [off-list ref] writes:
On Thu, 16 Jan 2020 at 01:48, Michael Ellerman [off-list ref] wrote:
quoted
Enable more hardening options.
Note BUG_ON_DATA_CORRUPTION selects DEBUG_LIST and is essentially just
a synonym for it.
DEBUG_SG, DEBUG_NOTIFIERS, DEBUG_LIST, DEBUG_CREDENTIALS and
SCHED_STACK_END_CHECK should all be low overhead and just add a few
extra checks.
Unselecting SLAB_MERGE_DEFAULT causes the SLAB to use more memory, but
the skiroot kernel shouldn't be memory constrained on any of our
systems, all it does is run a small bootloader.
Why do we unselect it?
The help text pretty much explains it:
config SLAB_MERGE_DEFAULT
bool "Allow slab caches to be merged"
default y
help
For reduced kernel memory fragmentation, slab caches can be
merged when they share the same size and other characteristics.
This carries a risk of kernel heap overflows being able to
overwrite objects from merged caches (and more easily control
cache layout), which makes such heap attacks easier to exploit
by attackers. By keeping caches unmerged, these kinds of exploits
can usually only damage objects in the same cache. To disable
merging at runtime, "slab_nomerge" can be passed on the kernel
command line.
So unselecting it uses a bit more memory but has some
security/robustness benefit.
I should probably also mention that it essentially has no effect because
we're also enabling SLUB_DEBUG_ON, and that causes some of the flags in
SLAB_NEVER_MERGE to be set, which also disables merging.
cheers