webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux: Randomize layout of sensitive kernel structures

Browse Source 
To quote from the kernel documentation:

> If you say Y here, the layouts of structures that are entirely
> function pointers (and have not been manually annotated with
> __no_randomize_layout), or structures that have been explicitly
> marked with __randomize_layout, will be randomized at compile-time.
> This can introduce the requirement of an additional information
> exposure vulnerability for exploits targeting these structure
> types.
>
> Enabling this feature will introduce some performance impact,
> slightly increase memory usage, and prevent the use of forensic
> tools like Volatility against the system (unless the kernel
> source tree isn't cleaned after kernel installation).
>
> The seed used for compilation is located at
> scripts/gcc-plgins/randomize_layout_seed.h. It remains after
> a make clean to allow for external modules to be compiled with
> the existing seed and will be removed by a make mrproper or
> make distclean.
>
> Note that the implementation requires gcc 4.7 or newer.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Peter Müller
2022-08-01 17:18:07 +00:00
parent 56256e6d2b
commit 4c46e7f818
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config/kernel/kernel.config.x86_64-ipfire
View File

@@ -793,7 +793,8 @@ CONFIG_HAVE_GCC_PLUGINS=y
CONFIG_GCC_PLUGINS=y
# CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set
CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y
# CONFIG_GCC_PLUGIN_RANDSTRUCT is not set
CONFIG_GCC_PLUGIN_RANDSTRUCT=y
CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
# end of General architecture-dependent options
CONFIG_RT_MUTEXES=y

5
config/rootfiles/common/armv6l/linux
View File

@@ -8071,6 +8071,8 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_ARM_SSP_PER_TASK
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_LATENT_ENTROPY
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
#lib/modules/KVER-ipfire/build/include/config/GCC_VERSION
@@ -12132,6 +12134,7 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/generated/autoconf.h
#lib/modules/KVER-ipfire/build/include/generated/bounds.h
#lib/modules/KVER-ipfire/build/include/generated/compile.h
#lib/modules/KVER-ipfire/build/include/generated/randomize_layout_hash.h
#lib/modules/KVER-ipfire/build/include/generated/timeconst.h
#lib/modules/KVER-ipfire/build/include/generated/uapi
#lib/modules/KVER-ipfire/build/include/generated/uapi/linux
@@ -17577,6 +17580,8 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.so
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.so
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_seed.h
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/sancov_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/stackleak_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/structleak_plugin.c

5
config/rootfiles/common/x86_64/linux
View File

@@ -7624,6 +7624,8 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/config/GARP
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_LATENT_ENTROPY
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK
#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
#lib/modules/KVER-ipfire/build/include/config/GCC_VERSION
@@ -12128,6 +12130,7 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/generated/autoconf.h
#lib/modules/KVER-ipfire/build/include/generated/bounds.h
#lib/modules/KVER-ipfire/build/include/generated/compile.h
#lib/modules/KVER-ipfire/build/include/generated/randomize_layout_hash.h
#lib/modules/KVER-ipfire/build/include/generated/timeconst.h
#lib/modules/KVER-ipfire/build/include/generated/uapi
#lib/modules/KVER-ipfire/build/include/generated/uapi/linux
@@ -17567,6 +17570,8 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.so
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.so
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_seed.h
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/sancov_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/stackleak_plugin.c
#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/structleak_plugin.c