Code

Add Tirdad patch to kernel#26

Code

Open

0xsirus wants to merge 106 commits intoanthraxx:masteranthraxx/linux-hardened:masterfrom 0xsirus:master0xsirus/linux-hardened:masterCopy head branch name to clipboard

+746-275

Commits

Commits on Feb 5, 2020

• make DEFAULT_MMAP_MIN_ADDR match LSM_MMAP_MIN_ADDR

  Show description for 8bc7636
  

  thestinger

  authored and

  anthraxx

  committed
  8bc7636

• enable HARDENED_USERCOPY by default

  Show description for a8488f5
  

  thestinger

  authored and

  anthraxx

  committed
  a8488f5

• disable HARDENED_USERCOPY_FALLBACK by default

  

  thestinger

  authored and

  anthraxx

  committed
  74df025

• enable SECURITY_DMESG_RESTRICT by default

  Show description for 4eb0d58
  

  thestinger

  authored and

  anthraxx

  committed
  4eb0d58

• set kptr_restrict=2 by default

  Show description for c51ecd0
  

  thestinger

  authored and

  anthraxx

  committed
  c51ecd0

• enable DEBUG_LIST by default

  Show description for d4adb1e
  

  thestinger

  authored and

  anthraxx

  committed
  d4adb1e

• enable BUG_ON_DATA_CORRUPTION by default

  Show description for 1ccc60c
  

  thestinger

  authored and

  anthraxx

  committed
  1ccc60c

• enable ARM64_SW_TTBR0_PAN by default

  

  thestinger

  authored and

  anthraxx

  committed
  1d4df4f

• arm64: enable RANDOMIZE_BASE by default

  

  thestinger

  authored and

  anthraxx

  committed
  8c8221b

• enable SLAB_FREELIST_RANDOM by default

  Show description for 522a7a8
  

  thestinger

  authored and

  anthraxx

  committed
  522a7a8

• enable SLAB_FREELIST_HARDENED by default

  

  thestinger

  authored and

  anthraxx

  committed
  e66a9db

• disable SLAB_MERGE_DEFAULT by default

  

  thestinger

  authored and

  anthraxx

  committed
  a54f690

• enable FORTIFY_SOURCE by default

  Show description for 6dc663b
  

  thestinger

  authored and

  anthraxx

  committed
  6dc663b

• enable PANIC_ON_OOPS by default

  Show description for 1b317c4
  

  thestinger

  authored and

  anthraxx

  committed
  1b317c4

• stop hiding SLUB_DEBUG behind EXPERT

  Show description for d6c6493
  

  thestinger

  authored and

  anthraxx

  committed
  d6c6493

• stop hiding X86_16BIT behind EXPERT

  

  thestinger

  authored and

  anthraxx

  committed
  3970d13

• disable X86_16BIT by default

  Show description for 3945314
  

  thestinger

  authored and

  anthraxx

  committed
  3945314

• stop hiding MODIFY_LDT_SYSCALL behind EXPERT

  

  thestinger

  authored and

  anthraxx

  committed
  8ffec63

• disable MODIFY_LDT_SYSCALL by default

  Show description for 9d44baa
  

  thestinger

  authored and

  anthraxx

  committed
  9d44baa

• set LEGACY_VSYSCALL_NONE by default

  

  thestinger

  authored and

  anthraxx

  committed
  f108bf6

• stop hiding AIO behind EXPERT

  

  Bernhard40

  authored and

  anthraxx

  committed
  fd40a80

• disable AIO by default

  

  Bernhard40

  authored and

  anthraxx

  committed
  7b271c4

• remove SYSVIPC from arm64/x86_64 defconfigs

  

  thestinger

  authored and

  anthraxx

  committed
  08bb496

• disable DEVPORT by default

  

  thestinger

  authored and

  anthraxx

  committed
  c01594f

• disable PROC_VMCORE by default

  

  thestinger

  authored and

  anthraxx

  committed
  1373658

• disable NFS_DEBUG by default

  

  thestinger

  authored and

  anthraxx

  committed
  b74b828

• enable DEBUG_WX by default

  Show description for 3014c2f
  

  thestinger

  authored and

  anthraxx

  committed
  3014c2f

• disable LEGACY_PTYS by default

  

  thestinger

  authored and

  anthraxx

  committed
  d2c3ec4

• disable DEVMEM by default

  

  thestinger

  authored and

  anthraxx

  committed
  a865724

• enable IO_STRICT_DEVMEM by default

  

  thestinger

  authored and

  anthraxx

  committed
  aaa4557

• disable COMPAT_BRK by default

  

  thestinger

  authored and

  anthraxx

  committed
  cf7b465

• use maximum supported mmap rnd entropy by default

  Show description for 250a7a8
  

  thestinger

  authored and

  anthraxx

  committed
  250a7a8

• enable protected_{symlinks,hardlinks} by default

  

  thestinger

  authored and

  anthraxx

  committed
  63ee9bb

• enable SECURITY by default

  

  thestinger

  authored and

  anthraxx

  committed
  e400d98

• enable SECURITY_YAMA by default

  

  thestinger

  authored and

  anthraxx

  committed
  b9c3132

• enable SECURITY_NETWORK by default

  

  thestinger

  authored and

  anthraxx

  committed
  e915334

• enable AUDIT by default

  

  thestinger

  authored and

  anthraxx

  committed
  128adb0

• enable SECURITY_SELINUX by default

  

  thestinger

  authored and

  anthraxx

  committed
  9a82a14

• enable SYN_COOKIES by default

  

  thestinger

  authored and

  anthraxx

  committed
  982fabd

• add __read_only for non-init related usage

  

  thestinger

  authored and

  anthraxx

  committed
  a32a012

• make sysctl constants read-only

  Show description for 3c64c49
  

  thestinger

  authored and

  anthraxx

  committed
  3c64c49

• mark kernel_set_to_readonly as __ro_after_init

  Show description for 6394f49
  

  thestinger

  authored and

  anthraxx

  committed
  6394f49

• mark slub runtime configuration as __ro_after_init

  Show description for 9682c78
  

  thestinger

  authored and

  anthraxx

  committed
  9682c78

• add __ro_after_init to slab_nomerge and slab_state

  Show description for 659c806
  

  thestinger

  authored and

  anthraxx

  committed
  659c806

• mark kmem_cache as __ro_after_init

  

  thestinger

  authored and

  anthraxx

  committed
  c2668ce

• mark __supported_pte_mask as __ro_after_init

  Show description for 080a508
  

  thestinger

  authored and

  anthraxx

  committed
  080a508

• mark kobj_ns_type_register as only used for init

  Show description for 12b1e2a
  

  thestinger

  authored and

  anthraxx

  committed
  12b1e2a

• mark open_softirq as only used for init

  

  thestinger

  authored and

  anthraxx

  committed
  9e3cfd8

• remove unused softirq_action callback parameter

  Show description for 114a072
  

  thestinger

  authored and

  anthraxx

  committed
  114a072

• mark softirq_vec as __ro_after_init

  Show description for 983d7af
  

  thestinger

  authored and

  anthraxx

  committed
  983d7af

• mm: slab: trigger BUG if requested object is not a slab page

  Show description for dd112cf
  

  thestinger

  authored and

  anthraxx

  committed
  dd112cf

• bug on kmem_cache_free with the wrong cache

  Show description for 1d286a3
  

  thestinger

  authored and

  anthraxx

  committed
  1d286a3

• bug on !PageSlab && !PageCompound in ksize

  Show description for da2673e
  

  thestinger

  authored and

  anthraxx

  committed
  da2673e

• mm: add support for verifying page sanitization

  Show description for bf7150e
  

  thestinger

  authored and

  anthraxx

  committed
  bf7150e

• slub: Extend init_on_free to slab caches with constructors

  Show description for 2c095f3
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  2c095f3

• slub: Add support for verifying slab sanitization

  Show description for 9458c89
  

  thestinger

  authored and

  anthraxx

  committed
  9458c89

• slub: add multi-purpose random canaries

  Show description for 2ce1956
  

  thestinger

  authored and

  anthraxx

  committed
  2ce1956

• security,perf: Allow further restriction of perf_event_open

  Show description for 468095d
  

  bwhacks

  authored and

  anthraxx

  committed
  468095d

• enable SECURITY_PERF_EVENTS_RESTRICT by default

  Show description for 99a3330
  

  thestinger

  authored and

  anthraxx

  committed
  99a3330

• add sysctl to disallow unprivileged CLONE_NEWUSER by default

  Show description for f5058d9
  

  hallyn

  authored and

  anthraxx

  committed
  f5058d9

• add kmalloc/krealloc alloc_size attributes

  Show description for ec73ebd
  

  thestinger

  authored and

  anthraxx

  committed
  ec73ebd

• add vmalloc alloc_size attributes

  Show description for 533c43f
  

  thestinger

  authored and

  anthraxx

  committed
  533c43f

• add kvmalloc alloc_size attribute

  Show description for fe1765f
  

  thestinger

  authored and

  anthraxx

  committed
  fe1765f

• add percpu alloc_size attributes

  Show description for eee3fa3
  

  thestinger

  authored and

  anthraxx

  committed
  eee3fa3

• add alloc_pages_exact alloc_size attributes

  Show description for 694cbc9
  

  thestinger

  authored and

  anthraxx

  committed
  694cbc9

• Add the extra_latent_entropy kernel parameter

  Show description for 0ca98c2
  

  ephox-gcc-plugins

  authored and

  anthraxx

  committed
  0ca98c2

• ata: avoid null pointer dereference on bug

  Show description for ecbd814
  

  thestinger

  authored and

  anthraxx

  committed
  ecbd814

• sanity check for negative length in nla_memcpy

  Show description for 14c10d0
  

  thestinger

  authored and

  anthraxx

  committed
  14c10d0

• add page destructor sanity check

  Show description for 5cc8adb
  

  thestinger

  authored and

  anthraxx

  committed
  5cc8adb

• PaX shadow cr4 sanity check (essentially a revert)

  Show description for 6973f4b
  

  thestinger

  authored and

  anthraxx

  committed
  6973f4b

• add writable function pointer detection

  Show description for eaa87f6
  

  thestinger

  authored and

  anthraxx

  committed
  eaa87f6

• support overriding early audit kernel cmdline

  

  thestinger

  authored and

  anthraxx

  committed
  5639af8

• FORTIFY_SOURCE intra-object overflow checking

  Show description for 8cc6f2c
  

  thestinger

  authored and

  anthraxx

  committed
  8cc6f2c

• Revert "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes"

  Show description for 224b56e
  

  thestinger

  authored and

  anthraxx

  committed
  224b56e

• x86_64: move vdso to mmap region from stack region

  Show description for 5bcddc9
  

  thestinger

  authored and

  anthraxx

  committed
  5bcddc9

• x86: determine stack entropy based on mmap entropy

  Show description for 8b31fc5
  

  thestinger

  authored and

  anthraxx

  committed
  8b31fc5

• arm64: determine stack entropy based on mmap entropy

  Show description for 01ece9e
  

  thestinger

  authored and

  anthraxx

  committed
  01ece9e

• randomize lower bits of the argument block

  Show description for b596f54
  

  thestinger

  authored and

  anthraxx

  committed
  b596f54

• x86_64: match arm64 brk randomization entropy

  Show description for 0f012fe
  

  thestinger

  authored and

  anthraxx

  committed
  0f012fe

• support randomizing the lower bits of brk

  Show description for 4f3d196
  

  thestinger

  authored and

  anthraxx

  committed
  4f3d196

• mm: randomize lower bits of brk

  Show description for 0e35de5
  

  thestinger

  authored and

  anthraxx

  committed
  0e35de5

• x86: randomize lower bits of brk

  Show description for e0da9d8
  

  thestinger

  authored and

  anthraxx

  committed
  e0da9d8

• mm: guarantee brk gap is at least one page

  Show description for b55113f
  

  thestinger

  authored and

  anthraxx

  committed
  b55113f

• x86: guarantee brk gap is at least one page

  Show description for 3a4c898
  

  thestinger

  authored and

  anthraxx

  committed
  3a4c898

• x86_64: bound mmap between legacy/modern bases

  

  thestinger

  authored and

  anthraxx

  committed
  293f984

• restrict device timing side channels

  Show description for 030e84d
  

  thestinger

  authored and

  anthraxx

  committed
  030e84d

• add toggle for disabling newly added USB devices

  Show description for b36b517
  

  thestinger

  authored and

  anthraxx

  committed
  b36b517

• hard-wire legacy checkreqprot option to 0

  Show description for cc19037
  

  thestinger

  authored and

  anthraxx

  committed
  cc19037

• security: tty: Add owner user namespace to tty_struct

  Show description for 941ac11
  

  nmatt0

  authored and

  anthraxx

  committed
  941ac11

• security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

  Show description for 3134273
  

  nmatt0

  authored and

  anthraxx

  committed
  3134273

• enable SECURITY_TIOCSTI_RESTRICT by default

  Show description for b3029bd
  

  thestinger

  authored and

  anthraxx

  committed
  b3029bd

• disable unprivileged eBPF access by default

  anthraxx

  committed
  69b5671

• enable BPF JIT hardening by default (if available)

  anthraxx

  committed
  453f635

• enable protected_{fifos,regular} by default

  anthraxx

  committed
  95d0499

• Revert "mark kernel_set_to_readonly as __ro_after_init"

  Show description for 51bb625
  anthraxx

  committed
  51bb625

• modpost: Add CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE

  Show description for 1336a9e
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  1336a9e

• mm: Fix extra_latent_entropy

  Show description for d803650
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  d803650

• add CONFIG for unprivileged_userns_clone

  Show description for 86bcf07
  anthraxx

  committed
  86bcf07

• enable INIT_ON_ALLOC_DEFAULT_ON by default

  anthraxx

  committed
  b9b5b84

• enable INIT_ON_FREE_DEFAULT_ON by default

  anthraxx

  committed
  a746e05

• add CONFIG for unprivileged_userfaultfd

  Show description for 922fadc
  anthraxx

  committed
  922fadc

• slub: Extend init_on_alloc to slab caches with constructors

  Show description for 932258a
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  932258a

Commits on Feb 19, 2020

• Tirdad patch (tcp.h)

  0xsirus

  authored
  fc730cc

• Tirdad patch (sequre_seq.c)

  0xsirus

  authored
  16be9f3

• Tirdad patch (sysctl_net_ipv4.c)

  0xsirus

  authored
  6e1815c

• Tirdad patch (tcp_input.c)

  0xsirus

  authored
  692c4af