diff options
| author | Kees Cook <kees@kernel.org> | 2025-07-17 16:25:17 -0700 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2025-07-21 21:41:48 -0700 |
| commit | 4c56d9f7e75eb2a137584f708fa262d7e8c8a2d8 (patch) | |
| tree | 28835289f51ad304f762dc5baf479d022fbdf656 | |
| parent | 76261fc7d1be3fde06efed859cb10c95b1204055 (diff) | |
configs/hardening: Enable CONFIG_KSTACK_ERASE
Since we can wipe the stack with both Clang and GCC plugins, enable this
for the "hardening.config" for wider testing.
Link: https://lore.kernel.org/r/20250717232519.2984886-12-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
| -rw-r--r-- | kernel/configs/hardening.config | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config index dd7c32fb5ac1..d24c2772d04d 100644 --- a/kernel/configs/hardening.config +++ b/kernel/configs/hardening.config @@ -63,6 +63,9 @@ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y # Initialize all stack variables to zero on function entry. CONFIG_INIT_STACK_ALL_ZERO=y +# Wipe kernel stack after syscall completion to reduce stale data lifetime. +CONFIG_KSTACK_ERASE=y + # Wipe RAM at reboot via EFI. For more details, see: # https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/ # https://bugzilla.redhat.com/show_bug.cgi?id=1532058 |