From: Marco Elver <elver@google.com>
To: elver@google.com, Kees Cook <keescook@chromium.org>
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>,
linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
Dmitry Vyukov <dvyukov@google.com>,
Alexander Potapenko <glider@google.com>,
kasan-dev@googlegroups.com, Matthieu Baerts <matttbe@kernel.org>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH] hardening: Enable KFENCE in the hardening config
Date: Mon, 12 Feb 2024 14:01:09 +0100 [thread overview]
Message-ID: <20240212130116.997627-1-elver@google.com> (raw)
KFENCE is not a security mitigation mechanism (due to sampling), but has
the performance characteristics of unintrusive hardening techniques.
When used at scale, however, it improves overall security by allowing
kernel developers to detect heap memory-safety bugs cheaply.
Link: https://lkml.kernel.org/r/79B9A832-B3DE-4229-9D87-748B2CFB7D12@kernel.org
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Marco Elver <elver@google.com>
---
kernel/configs/hardening.config | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index 95a400f042b1..79c865bfb116 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config
@@ -46,6 +46,9 @@ CONFIG_UBSAN_BOUNDS=y
# CONFIG_UBSAN_ALIGNMENT
CONFIG_UBSAN_SANITIZE_ALL=y
+# Sampling-based heap out-of-bounds and use-after-free detection.
+CONFIG_KFENCE=y
+
# Linked list integrity checking.
CONFIG_LIST_HARDENED=y
--
2.43.0.687.g38aa6559b0-goog
next reply other threads:[~2024-02-12 13:01 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-12 13:01 Marco Elver [this message]
2024-02-12 14:07 ` [PATCH] hardening: Enable KFENCE in the hardening config Matthieu Baerts
2024-02-12 19:04 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240212130116.997627-1-elver@google.com \
--to=elver@google.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=gustavoars@kernel.org \
--cc=kasan-dev@googlegroups.com \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matttbe@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox