From patchwork Fri Jun 25 08:42:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin Ian King X-Patchwork-Id: 1497050 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4GB9VT3hy0z9sRK; Fri, 25 Jun 2021 18:42:25 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1lwhPn-0005S7-Hy; Fri, 25 Jun 2021 08:42:19 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1lwhPm-0005S1-5F for kernel-team@lists.ubuntu.com; Fri, 25 Jun 2021 08:42:18 +0000 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1lwhPl-0008Po-Tb; Fri, 25 Jun 2021 08:42:17 +0000 From: Colin King To: kernel-team@lists.ubuntu.com Subject: [PATCH][IMPISH] UBUNTU: [Config] Enable CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT Date: Fri, 25 Jun 2021 09:42:17 +0100 Message-Id: <20210625084217.7413-1-colin.king@canonical.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Colin Ian King Kernel stack offset randomization is a useful security feature that should be enabled. Benchmarking showed that the impact is within the noise of various microbenchmarks so I believe this has some added benefit with minimal performance impact. The security folk believe this is worth enabling, so lets switch it on. Signed-off-by: Colin Ian King Acked-by: Krzysztof Kozlowski Acked-by: Seth Forshee --- debian.master/config/config.common.ubuntu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu index ab828d5..0b46c98 100644 --- a/debian.master/config/config.common.ubuntu +++ b/debian.master/config/config.common.ubuntu @@ -8415,7 +8415,7 @@ CONFIG_RAID6_PQ_BENCHMARK=y CONFIG_RAID_ATTRS=m # CONFIG_RANDOM32_SELFTEST is not set CONFIG_RANDOMIZE_BASE=y -# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set +CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y CONFIG_RANDOMIZE_MEMORY=y CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa CONFIG_RANDOMIZE_MODULE_REGION_FULL=y