torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

mm: security: Allow default HARDENED_USERCOPY to be set at compile time

Browse Source 
HARDENED_USERCOPY defaults to on if enabled at compile time. Allow
hardened_usercopy= default to be set at compile time similar to
init_on_alloc= and init_on_free=. The intent is that hardening
options that can be disabled at runtime can set their default at
build time.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Link: https://lore.kernel.org/r/20250123221115.19722-3-mgorman@techsingularity.net
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Mel Gorman 2025-01-23 22:11:13 +00:00 committed by Kees Cook
parent f4d4e8b9d6
commit d2132f453e
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/admin-guide/kernel-parameters.txt
View File

@ -1785,7 +1785,9 @@
allocation boundaries as a proactive defense
against bounds-checking flaws in the kernel's
copy_to_user()/copy_from_user() interface.
on Perform hardened usercopy checks (default).
The default is determined by
CONFIG_HARDENED_USERCOPY_DEFAULT_ON.
on Perform hardened usercopy checks.
off Disable hardened usercopy checks.
hardlockup_all_cpu_backtrace=

3
mm/usercopy.c
View File

@ -255,7 +255,8 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
}
EXPORT_SYMBOL(__check_object_size);
static bool enable_checks __initdata = true;
static bool enable_checks __initdata =
IS_ENABLED(CONFIG_HARDENED_USERCOPY_DEFAULT_ON);
static int __init parse_hardened_usercopy(char *str)
{

8
security/Kconfig.hardening
View File

@ -294,6 +294,14 @@ config HARDENED_USERCOPY
or are part of the kernel text. This prevents entire classes
of heap overflow exploits and similar kernel memory exposures.
config HARDENED_USERCOPY_DEFAULT_ON
bool "Harden memory copies by default"
depends on HARDENED_USERCOPY
default HARDENED_USERCOPY
help
This has the effect of setting "hardened_usercopy=on" on the kernel
command line. This can be disabled with "hardened_usercopy=off".
endmenu
menu "Hardening of kernel data structures"