summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to '4567_distro-Gentoo-Kconfig.patch')
-rw-r--r--4567_distro-Gentoo-Kconfig.patch72
1 files changed, 64 insertions, 8 deletions
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 56adbbd8..635de00b 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,9 +6,9 @@
source "Documentation/Kconfig"
+
+source "distro/Kconfig"
---- /dev/null 2021-06-06 14:01:09.950742356 -0400
-+++ b/distro/Kconfig 2021-06-06 17:48:05.912077568 -0400
-@@ -0,0 +1,267 @@
+--- /dev/null 2021-06-08 16:56:49.698138501 -0400
++++ b/distro/Kconfig 2021-06-08 17:11:33.377999003 -0400
+@@ -0,0 +1,263 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -181,8 +181,7 @@
+ Note 2: Please see the URL above for numeric settings, e.g. CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
+ for X86_64
+
-+ depends on GENTOO_LINUX && !HARDENED_USERCOPY_FALLBACK && !HARDENED_USERCOPY_PAGESPAN && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !DEVKMEM && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !SECURITY_SELINUX_DISABLE && !X86_X32 && !MODIFY_LDT_SYSCALL
-+
++ depends on GENTOO_LINUX && !ACPI_CUSTOM_METHOD && !COMPAT_BRK && !DEVKMEM && !PROC_KCORE && !COMPAT_VDSO && !KEXEC && !HIBERNATION && !LEGACY_PTYS && !X86_X32 && !MODIFY_LDT_SYSCALL
+
+ select BUG
+ select STRICT_KERNEL_RWX
@@ -191,7 +190,6 @@
+ select STACKPROTECTOR_STRONG
+ select STRICT_DEVMEM
+ select IO_STRICT_DEVMEM
-+
+ select SYN_COOKIES
+ select DEBUG_CREDENTIALS
+ select DEBUG_NOTIFIERS
@@ -201,9 +199,7 @@
+ select SCHED_STACK_END_CHECK
+ select SECCOMP
+ select SECCOMP_FILTER
-+ select SECURITY
+ select SECURITY_YAMA
-+ select HARDENED_USERCOPY
+ select SLAB_FREELIST_RANDOM
+ select SLAB_FREELIST_HARDENED
+ select SHUFFLE_PAGE_ALLOCATOR
@@ -276,3 +272,63 @@
+endmenu
+
+endmenu
+diff --git a/security/Kconfig b/security/Kconfig
+index 7561f6f99..01f0bf73f 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -166,6 +166,7 @@ config HARDENED_USERCOPY
+ config HARDENED_USERCOPY_FALLBACK
+ bool "Allow usercopy whitelist violations to fallback to object size"
+ depends on HARDENED_USERCOPY
++ depends on !GENTOO_KERNEL_SELF_PROTECTION
+ default y
+ help
+ This is a temporary option that allows missing usercopy whitelists
+@@ -181,6 +182,7 @@ config HARDENED_USERCOPY_PAGESPAN
+ bool "Refuse to copy allocations that span multiple pages"
+ depends on HARDENED_USERCOPY
+ depends on EXPERT
++ depends on !GENTOO_KERNEL_SELF_PROTECTION
+ help
+ When a multi-page allocation is done without __GFP_COMP,
+ hardened usercopy will reject attempts to copy it. There are,
+diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
+index 9e921fc72..f29bc13fa 100644
+--- a/security/selinux/Kconfig
++++ b/security/selinux/Kconfig
+@@ -26,6 +26,7 @@ config SECURITY_SELINUX_BOOTPARAM
+ config SECURITY_SELINUX_DISABLE
+ bool "NSA SELinux runtime disable"
+ depends on SECURITY_SELINUX
++ depends on !GENTOO_KERNEL_SELF_PROTECTION
+ select SECURITY_WRITABLE_HOOKS
+ default n
+ help
+--
+2.31.1
+
+From bd3ff0b16792c18c0614c2b95e148943209f460a Mon Sep 17 00:00:00 2001
+From: Georgy Yakovlev <gyakovlev@gentoo.org>
+Date: Tue, 8 Jun 2021 13:59:57 -0700
+Subject: [PATCH 2/2] set DEFAULT_MMAP_MIN_ADDR by default
+
+---
+ mm/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/mm/Kconfig b/mm/Kconfig
+index 24c045b24..e13fc740c 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -321,6 +321,8 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+ int "Low address space to protect from user allocation"
+ depends on MMU
++ default 65536 if ( X86_64 || X86_32 || PPC64 || IA64 ) && GENTOO_KERNEL_SELF_PROTECTION
++ default 32768 if ( ARM64 || ARM ) && GENTOO_KERNEL_SELF_PROTECTION
+ default 4096
+ help
+ This is the portion of low virtual memory which should be protected
+--
+2.31.1
+```