From cfad299c9b2918e8fc24b0fc7548152e9201e924 Mon Sep 17 00:00:00 2001 From: Dennis Cagle Date: Wed, 22 Jan 2020 12:29:01 -0800 Subject: [PATCH] defconfig: Add kernel hardening features Add recommended kernel hardening features and configs to help with testing. Change-Id: I143401d4eff439417ba460f1fc84b4d24817d903 Signed-off-by: Dennis Cagle --- arch/arm64/configs/vendor/genericarmv8-64_defconfig | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/arch/arm64/configs/vendor/genericarmv8-64_defconfig b/arch/arm64/configs/vendor/genericarmv8-64_defconfig index 80195c50f998..cf02e6e64f63 100644 --- a/arch/arm64/configs/vendor/genericarmv8-64_defconfig +++ b/arch/arm64/configs/vendor/genericarmv8-64_defconfig @@ -28,6 +28,9 @@ CONFIG_SCHED_AUTOGROUP=y CONFIG_BLK_DEV_INITRD=y CONFIG_KALLSYMS_ALL=y # CONFIG_COMPAT_BRK is not set +CONFIG_SLAB_FREELIST_RANDOM=y +CONFIG_SLAB_FREELIST_HARDENED=y +# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set CONFIG_PROFILING=y CONFIG_ARM64_VA_BITS_48=y CONFIG_SCHED_MC=y @@ -362,7 +365,11 @@ CONFIG_NFS_V4_2=y CONFIG_ROOT_NFS=y CONFIG_NLS_CODEPAGE_437=y CONFIG_NLS_ISO8859_1=y +CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y CONFIG_SECURITY=y +CONFIG_HARDENED_USERCOPY=y +# CONFIG_HARDENED_USERCOPY_FALLBACK is not set +CONFIG_FORTIFY_SOURCE=y CONFIG_CRYPTO_AUTHENC=m CONFIG_CRYPTO_ECDH=m CONFIG_CRYPTO_ECHAINIV=y @@ -381,5 +388,7 @@ CONFIG_MAGIC_SYSRQ=y CONFIG_DEBUG_KERNEL=y # CONFIG_SCHED_DEBUG is not set # CONFIG_DEBUG_PREEMPT is not set +CONFIG_DEBUG_CREDENTIALS=y # CONFIG_FTRACE is not set CONFIG_MEMTEST=y +CONFIG_BUG_ON_DATA_CORRUPTION=y