From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E046C35247 for ; Wed, 5 Feb 2020 22:40:43 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id 96F5C214AF for ; Wed, 5 Feb 2020 22:40:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 96F5C214AF Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-17675-kernel-hardening=archiver.kernel.org@lists.openwall.com Received: (qmail 9930 invoked by uid 550); 5 Feb 2020 22:39:54 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Received: (qmail 9832 invoked from network); 5 Feb 2020 22:39:53 -0000 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,407,1574150400"; d="scan'208";a="225092448" From: Kristen Carlson Accardi To: tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, hpa@zytor.com, arjan@linux.intel.com, keescook@chromium.org Cc: rick.p.edgecombe@intel.com, x86@kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Kristen Carlson Accardi Subject: [RFC PATCH 05/11] x86: Makefile: Add build and config option for CONFIG_FG_KASLR Date: Wed, 5 Feb 2020 14:39:44 -0800 Message-Id: <20200205223950.1212394-6-kristen@linux.intel.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200205223950.1212394-1-kristen@linux.intel.com> References: <20200205223950.1212394-1-kristen@linux.intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Allow user to select CONFIG_FG_KASLR if dependencies are met. Change the make file to build with -ffunction-sections if CONFIG_FG_KASLR Signed-off-by: Kristen Carlson Accardi --- Makefile | 4 ++++ arch/x86/Kconfig | 13 +++++++++++++ 2 files changed, 17 insertions(+) diff --git a/Makefile b/Makefile index c50ef91f6136..41438a921666 100644 --- a/Makefile +++ b/Makefile @@ -846,6 +846,10 @@ ifdef CONFIG_LIVEPATCH KBUILD_CFLAGS += $(call cc-option, -flive-patching=inline-clone) endif +ifdef CONFIG_FG_KASLR +KBUILD_CFLAGS += -ffunction-sections +endif + # arch Makefile may override CC so keep this after arch Makefile is included NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 5e8949953660..b4b1b17076a8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2208,6 +2208,19 @@ config RANDOMIZE_BASE If unsure, say Y. +config FG_KASLR + bool "Finer grained Kernel Address Space Layout Randomization" + depends on $(cc-option, -ffunction-sections) + depends on RANDOMIZE_BASE && X86_64 + help + This option improves the randomness of the kernel text + over basic Kernel Address Space Layout Randomization (KASLR) + by reordering the kernel text at boot time. This feature + uses information generated at compile time to re-layout the + kernel text section at boot time at function level granularity. + + If unsure, say N. + # Relocation on x86 needs some additional build support config X86_NEED_RELOCS def_bool y -- 2.24.1