archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:24:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

mm: security: Move hardened usercopy under 'Kernel hardening options'

Browse source 
There is a submenu for 'Kernel hardening options' under "Security".
Move HARDENED_USERCOPY under the hardening options as it is clearly
related.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250123221115.19722-2-mgorman@techsingularity.net
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Mel Gorman 2025-01-23 22:11:12 +00:00 • committed by Kees Cook
parent 808aac63e2
commit f4d4e8b9d6
2 changed files with 16 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

12
security/Kconfig
View file

@ -164,18 +164,6 @@ config LSM_MMAP_MIN_ADDR
this low address space will need the permission specific to the
systems running LSM.
config HARDENED_USERCOPY
bool "Harden memory copies between kernel and userspace"
imply STRICT_DEVMEM
help
This option checks for obviously wrong memory regions when
copying memory to/from the kernel (via copy_to_user() and
copy_from_user() functions) by rejecting memory ranges that
are larger than the specified heap object, span multiple
separately allocated pages, are not on the process stack,
or are part of the kernel text. This prevents entire classes
of heap overflow exploits and similar kernel memory exposures.
config FORTIFY_SOURCE
bool "Harden common str/mem functions against buffer overflows"
depends on ARCH_HAS_FORTIFY_SOURCE

16
security/Kconfig.hardening
View file

@ -280,6 +280,22 @@ config ZERO_CALL_USED_REGS
endmenu
menu "Bounds checking"
config HARDENED_USERCOPY
bool "Harden memory copies between kernel and userspace"
imply STRICT_DEVMEM
help
This option checks for obviously wrong memory regions when
copying memory to/from the kernel (via copy_to_user() and
copy_from_user() functions) by rejecting memory ranges that
are larger than the specified heap object, span multiple
separately allocated pages, are not on the process stack,
or are part of the kernel text. This prevents entire classes
of heap overflow exploits and similar kernel memory exposures.
endmenu
menu "Hardening of kernel data structures"
config LIST_HARDENED