Since we can wipe the stack with both Clang and GCC plugins, enable this for the "hardening.config" for wider testing.
Signed-off-by: Kees Cook kees@kernel.org --- Cc: "Gustavo A. R. Silva" gustavoars@kernel.org Cc: linux-hardening@vger.kernel.org --- kernel/configs/hardening.config | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config index dd7c32fb5ac1..d24c2772d04d 100644 --- a/kernel/configs/hardening.config +++ b/kernel/configs/hardening.config @@ -63,6 +63,9 @@ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y # Initialize all stack variables to zero on function entry. CONFIG_INIT_STACK_ALL_ZERO=y
+# Wipe kernel stack after syscall completion to reduce stale data lifetime. +CONFIG_KSTACK_ERASE=y + # Wipe RAM at reboot via EFI. For more details, see: # https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-res... # https://bugzilla.redhat.com/show_bug.cgi?id=1532058