commit: 6188b97edf588f87d24e35068083a8561d152f91 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun May 5 17:54:13 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun May 5 18:06:28 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6188b97e
Update to KSPP patch Bug: https://bugs.gentoo.org/930733 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 4567_distro-Gentoo-Kconfig.patch | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch index 6134393f..87b8fa95 100644 --- a/4567_distro-Gentoo-Kconfig.patch +++ b/4567_distro-Gentoo-Kconfig.patch @@ -6,9 +6,9 @@ source "Documentation/Kconfig" + +source "distro/Kconfig" ---- /dev/null 2024-04-27 13:10:54.188000027 -0400 -+++ b/distro/Kconfig 2024-04-27 17:56:56.723132353 -0400 -@@ -0,0 +1,295 @@ +--- /dev/null 2024-05-05 10:40:37.103999988 -0400 ++++ b/distro/Kconfig 2024-05-05 13:37:37.699554927 -0400 +@@ -0,0 +1,310 @@ +menu "Gentoo Linux" + +config GENTOO_LINUX @@ -178,7 +178,7 @@ + to unmet dependencies. Search for GENTOO_KERNEL_SELF_PROTECTION_COMMON and search for + GENTOO_KERNEL_SELF_PROTECTION_{X86_64, ARM64, X86_32, ARM} for dependency information on your + specific architecture. -+ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 ++ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 + for X86_64 + +if GENTOO_KERNEL_SELF_PROTECTION @@ -201,10 +201,13 @@ + select DEBUG_SG + select HARDENED_USERCOPY if HAVE_HARDENED_USERCOPY_ALLOCATOR=y + select KFENCE if HAVE_ARCH_KFENCE && (!SLAB || SLUB) ++ select PAGE_TABLE_CHECK if ARCH_SUPPORTS_PAGE_TABLE_CHECK=y && EXCLUSIVE_SYSTEM_RAM=y ++ select PAGE_TABLE_CHECK_ENFORCED if PAGE_TABLE_CHECK=y + select RANDOMIZE_KSTACK_OFFSET_DEFAULT if HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET && (INIT_STACK_NONE || !CC_IS_CLANG || CLANG_VERSION>=140000) + select SECURITY_LANDLOCK + select SCHED_CORE if SCHED_SMT + select BUG_ON_DATA_CORRUPTION ++ select RANDOM_KMALLOC_CACHE if SLUB_TINY=n + select SCHED_STACK_END_CHECK + select SECCOMP if HAVE_ARCH_SECCOMP + select SECCOMP_FILTER if HAVE_ARCH_SECCOMP_FILTER @@ -245,11 +248,13 @@ + default n + + select GCC_PLUGIN_STACKLEAK ++ select X86_KERNEL_IBT if CC_HAS_IBT=y && HAVE_OBJTOOL=y && (!LD_IS_LLD=n || LLD_VERSION>=140000) + select LEGACY_VSYSCALL_NONE + select PAGE_TABLE_ISOLATION + select RANDOMIZE_BASE + select RANDOMIZE_MEMORY + select RELOCATABLE ++ select X86_USER_SHADOW_STACK if AS_WRUSS=Y + select VMAP_STACK + + @@ -259,11 +264,21 @@ + depends on ARM64 + default n + -+ select RANDOMIZE_BASE -+ select RELOCATABLE ++ select ARM64_BTI ++ select ARM64_E0PD ++ select ARM64_EPAN if ARM64_PAN=y ++ select ARM64_MTE if (ARM64_AS_HAS_MTE=y && ARM64_TAGGED_ADDR_ABI=y ) && ( AS_HAS_ARMV8_5=y ) && ( AS_HAS_LSE_ATOMICS=y ) && ( ARM64_PAN=y ) ++ select ARM64_PTR_AUTH ++ select ARM64_PTR_AUTH_KERNEL if ( ARM64_PTR_AUTH=y ) && (( CC_HAS_SIGN_RETURN_ADDRESS=y || CC_HAS_BRANCH_PROT_PAC_RET=y ) && AS_HAS_ARMV8_3=y ) && ( LD_IS_LLD=y || LD_VERSION >= 23301 || ( CC_IS_GCC=y && GCC_VERSION < 90100 )) && (CC_IS_CLANG=n || AS_HAS_CFI_NEGATE_RA_STATE=y ) && ((FUNCTION_GRAPH_TRACER=n || DYNAMIC_FTRACE_WITH_ARGS=y )) ++ select ARM64_BTI_KERNEL if ( ARM64_BTI=y ) && ( ARM64_PTR_AUTH_KERNEL=y ) && ( CC_HAS_BRANCH_PROT_PAC_RET_BTI=y ) && (CC_IS_GCC=n || GCC_VERSION >= 100100 ) && (CC_IS_GCC=n ) && ((FUNCTION_GRAPH_TRACE=n || DYNAMIC_FTRACE_WITH_ARG=y )) + select ARM64_SW_TTBR0_PAN + select CONFIG_UNMAP_KERNEL_AT_EL0 + select GCC_PLUGIN_STACKLEAK ++ select KASAN_HW_TAGS if HAVE_ARCH_KASAN_HW_TAGS=y ++ select RANDOMIZE_BASE ++ select RELOCATABLE ++ select SHADOW_CALL_STACK if ARCH_SUPPORTS_SHADOW_CALL_STACK=y && (DYNAMIC_FTRACE_WITH_ARGS=y || DYNAMIC_FTRACE_WITH_REGS=y || FUNCTION_GRAPH_TRACER=n) && MMU=y ++ select UNWIND_PATCH_PAC_INTO_SCS if (CC_IS_CLANG=y && CLANG_VERSION >= CONFIG_150000 ) && ( ARM64_PTR_AUTH_KERNEL=y && CC_HAS_BRANCH_PROT_PAC_RET=y ) && ( SHADOW_CALL_STACK=y ) + select VMAP_STACK + +config GENTOO_KERNEL_SELF_PROTECTION_X86_32 @@ -304,12 +319,6 @@ + See the settings that become available for more details and fine-tuning. + +endmenu -From bd3ff0b16792c18c0614c2b95e148943209f460a Mon Sep 17 00:00:00 2001 -From: Georgy Yakovlev <gyakov...@gentoo.org> -Date: Tue, 8 Jun 2021 13:59:57 -0700 -Subject: [PATCH 2/2] set DEFAULT_MMAP_MIN_ADDR by default - ---- mm/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
