From patchwork Sun Jan 19 13:10:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Hicks X-Patchwork-Id: 1225452 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 480wCy65P2z9sRs; Mon, 20 Jan 2020 00:11:10 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1itAM6-0007QH-Jn; Sun, 19 Jan 2020 13:11:06 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1itAM4-0007OM-EG for kernel-team@lists.ubuntu.com; Sun, 19 Jan 2020 13:11:04 +0000 Received: from 2.general.tyhicks.uk.vpn ([10.172.192.53] helo=sec.lxd) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1itAM3-0004re-9d; Sun, 19 Jan 2020 13:11:03 +0000 From: Tyler Hicks To: kernel-team@lists.ubuntu.com Subject: [PATCH 8/8] UBUNTU: [Config] Disable the uselib system call Date: Sun, 19 Jan 2020 13:10:29 +0000 Message-Id: <20200119131029.23160-9-tyhicks@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200119131029.23160-1-tyhicks@canonical.com> References: <20200119131029.23160-1-tyhicks@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" BugLink: https://launchpad.net/bugs/1855341 Disable CONFIG_USELIB to make the uselib(2) system call unreachable in an effort to reduce the kernel attack surface. The system call is only used by very old libc implementations and is unlikely to be used today. Signed-off-by: Tyler Hicks --- debian.master/config/annotations | 3 ++- debian.master/config/config.common.ubuntu | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/debian.master/config/annotations b/debian.master/config/annotations index 064d0d0ed278..07998d2822a1 100644 --- a/debian.master/config/annotations +++ b/debian.master/config/annotations @@ -10289,7 +10289,7 @@ CONFIG_SWAP policy<{'amd64': 'y', 'arm64': ' CONFIG_SYSVIPC policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_POSIX_MQUEUE policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_CROSS_MEMORY_ATTACH policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> -CONFIG_USELIB policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> +CONFIG_USELIB policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 'ppc64el': 'n', 's390x': 'n'}> CONFIG_AUDIT policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_CPU_ISOLATION policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_IKCONFIG policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 'ppc64el': 'n', 's390x': 'n'}> @@ -10316,6 +10316,7 @@ CONFIG_SHUFFLE_PAGE_ALLOCATOR policy<{'amd64': 'y', 'arm64': ' CONFIG_SLUB_CPU_PARTIAL policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_PROFILING policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}> # +CONFIG_USELIB mark note CONFIG_SYSFS_DEPRECATED mark note CONFIG_COMPAT_BRK mark note CONFIG_NUMA_BALANCING_DEFAULT_ENABLED note diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu index fe8a065e2262..f2d01e7b1e1b 100644 --- a/debian.master/config/config.common.ubuntu +++ b/debian.master/config/config.common.ubuntu @@ -10788,7 +10788,7 @@ CONFIG_USB_ZD1201=m CONFIG_USB_ZERO=m # CONFIG_USB_ZERO_HNPTEST is not set CONFIG_USB_ZR364XX=m -CONFIG_USELIB=y +# CONFIG_USELIB is not set CONFIG_USERFAULTFD=y CONFIG_USERIO=m CONFIG_USER_NS=y