webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux: Give CONFIG_RANDOMIZE_BASE on aarch64 another try

Browse Source 
Quoted from https://capsule8.com/blog/kernel-configuration-glossary/:

> Significance: Critical
>
> In support of Kernel Address Space Layout Randomization (KASLR) this randomizes
> the physical address at which the kernel image is decompressed and the virtual
> address where the kernel image is mapped as a security feature that deters
> exploit attempts relying on knowledge of the location of kernel code internals.

We tried to enable this back in 2020, and failed. Since then, things
may have been improved, so let's give this low-hanging fruit another
try.

Fixes: #12363
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
This commit is contained in:
Peter Müller
2022-07-11 15:07:22 +00:00
parent 67261075a3
commit 7caecf45fb
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/kernel/kernel.config.aarch64-ipfire
View File

@@ -471,7 +471,7 @@ CONFIG_ARM64_SVE=y
CONFIG_ARM64_MODULE_PLTS=y
# CONFIG_ARM64_PSEUDO_NMI is not set
CONFIG_RELOCATABLE=y
# CONFIG_RANDOMIZE_BASE is not set
CONFIG_RANDOMIZE_BASE=y
CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
CONFIG_STACKPROTECTOR_PER_TASK=y
# end of Kernel Features

1
config/rootfiles/common/aarch64/linux
View File

@@ -9427,6 +9427,7 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/config/RAID6_PQ
#lib/modules/KVER-ipfire/build/include/config/RAID6_PQ_BENCHMARK
#lib/modules/KVER-ipfire/build/include/config/RAID_ATTRS
#lib/modules/KVER-ipfire/build/include/config/RANDOMIZE_BASE
#lib/modules/KVER-ipfire/build/include/config/RANDOMIZE_KSTACK_OFFSET_DEFAULT
#lib/modules/KVER-ipfire/build/include/config/RAS
#lib/modules/KVER-ipfire/build/include/config/RASPBERRYPI_FIRMWARE