[OS-BUILD PATCHv2 0/6] Enable hardened configs for Fedora and ARK

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

Improve Fedora and ARK kernel hardening by enabling the following
configs:

CONFIG_GCC_PLUGIN_STACKLEAK
CONFIG_SCHED_STACK_END_CHECK
CONFIG_BUG_ON_DATA_CORRUPTION
CONFIG_SLAB_FREELIST_HARDENED (already enabled in Fedora)
CONFIG_PAGE_POISONING

These were tested by the RHEL performance engineering team.  No
measurable performance impact was detected.

[OS-BUILD PATCHv2 1/6] redhat/configs: Enable CONFIG_SCHED_STACK_END_CHECK for Fedora and ARK

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

redhat/configs: Enable CONFIG_SCHED_STACK_END_CHECK for Fedora and ARK

CONFIG_SCHED_STACK_END_CHECK checks for stack overrun in calls to
schedule().  In internal testing, it had no measurable performance
impact.

Enable it for Fedora and ARK.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1856174
Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

diff a/redhat/configs/common/generic/CONFIG_SCHED_STACK_END_CHECK
b/redhat/configs/common/generic/CONFIG_SCHED_STACK_END_CHECK
--- a/redhat/configs/common/generic/CONFIG_SCHED_STACK_END_CHECK
+++ b/redhat/configs/common/generic/CONFIG_SCHED_STACK_END_CHECK
@@ -1 +1 @@
-# CONFIG_SCHED_STACK_END_CHECK is not set
+CONFIG_SCHED_STACK_END_CHECK=y

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

[OS-BUILD PATCHv2 2/6] redhat/configs: Enable CONFIG_BUG_ON_DATA_CORRUPTION for Fedora and ARK

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

redhat/configs: Enable CONFIG_BUG_ON_DATA_CORRUPTION for Fedora and ARK

CONFIG_BUG_ON_DATA_CORRUPTION turns on corruption detection for all
linked lists.  In our internal testing, it had no measurable impact on
performance.

Enable it for Fedora and ARK.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1856174
Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

diff a/redhat/configs/ark/generic/CONFIG_BUG_ON_DATA_CORRUPTION
b/redhat/configs/ark/generic/CONFIG_BUG_ON_DATA_CORRUPTION
--- a/redhat/configs/ark/generic/CONFIG_BUG_ON_DATA_CORRUPTION
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_BUG_ON_DATA_CORRUPTION is not set
diff a/redhat/configs/fedora/generic/CONFIG_BUG_ON_DATA_CORRUPTION
b/redhat/configs/common/generic/CONFIG_BUG_ON_DATA_CORRUPTION
--- a/redhat/configs/fedora/generic/CONFIG_BUG_ON_DATA_CORRUPTION
+++ b/redhat/configs/common/generic/CONFIG_BUG_ON_DATA_CORRUPTION

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

[OS-BUILD PATCHv2 3/6] redhat/configs: Enable CONFIG_SLAB_FREELIST_HARDENED for ARK

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

redhat/configs: Enable CONFIG_SLAB_FREELIST_HARDENED for ARK

CONFIG_SLAB_FREELIST_HARDENED adds hardening to the slab allocator.
In our internal testing, it had no measurable performance impact.

It's already enabled for Fedora; enable it for ARK as well.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1856174
Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

diff a/redhat/configs/ark/generic/CONFIG_SLAB_FREELIST_HARDENED
b/redhat/configs/ark/generic/CONFIG_SLAB_FREELIST_HARDENED
--- a/redhat/configs/ark/generic/CONFIG_SLAB_FREELIST_HARDENED
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_SLAB_FREELIST_HARDENED is not set
diff a/redhat/configs/fedora/generic/CONFIG_SLAB_FREELIST_HARDENED
b/redhat/configs/common/generic/CONFIG_SLAB_FREELIST_HARDENED
--- a/redhat/configs/fedora/generic/CONFIG_SLAB_FREELIST_HARDENED
+++ b/redhat/configs/common/generic/CONFIG_SLAB_FREELIST_HARDENED

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

[OS-BUILD PATCHv2 4/6] redhat/configs: Enable CONFIG_PAGE_POISONING for Fedora and ARK

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

redhat/configs: Enable CONFIG_PAGE_POISONING for Fedora and ARK

CONFIG_PAGE_POISONING adds page poisoning to harden against information
leaks from freed data.  In our internal testing, it had no measurable
performance impact.

Enable it for Fedora and ARK.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1856174
Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

diff a/redhat/configs/common/generic/CONFIG_PAGE_POISONING
b/redhat/configs/common/generic/CONFIG_PAGE_POISONING
--- a/redhat/configs/common/generic/CONFIG_PAGE_POISONING
+++ b/redhat/configs/common/generic/CONFIG_PAGE_POISONING
@@ -1 +1 @@
-# CONFIG_PAGE_POISONING is not set
+CONFIG_PAGE_POISONING=y

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

[OS-BUILD PATCHv2 5/6] Revert "redhat/configs: Enable CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL"

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

Revert "redhat/configs: Enable CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL"

Disable GCC plugins until it becomes possible to build them with a
slight GCC mismatch.

This reverts commit 2fd1e830288d6a727fa4d02152db9527151697a6.

diff a/redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
b/redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
--- a/redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
diff a/redhat/configs/common/debug/CONFIG_INIT_STACK_NONE
b/redhat/configs/common/debug/CONFIG_INIT_STACK_NONE
--- a/redhat/configs/common/debug/CONFIG_INIT_STACK_NONE
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_INIT_STACK_NONE=y
diff a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
b/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
--- a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
+++ b/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
@@ -1 +1 @@
-CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
+# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
diff a/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE
b/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE
--- a/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE
+++ b/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE
@@ -1 +1 @@
-# CONFIG_INIT_STACK_NONE is not set
+CONFIG_INIT_STACK_NONE=y

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

[OS-BUILD PATCHv2 6/6] Revert "redhat/configs: Enable CONFIG_GCC_PLUGIN_STRUCTLEAK"

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

Revert "redhat/configs: Enable CONFIG_GCC_PLUGIN_STRUCTLEAK"

Disable plugins until it becomes possible to build them with a slight
GCC mismatch.

This reverts commit 489e997819d13f528ad91c5c4264ec34bca5bba7.

diff a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK
b/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK
--- a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_GCC_PLUGIN_STRUCTLEAK=y
diff a/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK
b/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK
--- /dev/null
+++ b/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK
@@ -0,0 +1 @@
+# CONFIG_GCC_PLUGIN_STRUCTLEAK is not set
diff a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE
b/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE
--- a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE
+++ b/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961#note_52631...

Removed the stackleak plugin from the bunch, and reverted the previous
structleak plugin.

[Justin Forbes (via Email Bridge)]

From: Justin Forbes on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961#note_52635...

Thanks, for what it is worth, I think there is value in enabling them,
but watching the upstream conversation, I am not convinced that we will
get a practical solution in the near term.

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961#note_52638...

Linus and Kees have acknowledged it's a valid problem, so I'm thinking
we'll get it fixed relatively soon.

[Waiman Long (via Email Bridge)]

From: Waiman Long on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961#note_53099...

The patchset looks good to me. Of the four config options,
PAGE_POISONING is the one that definitely has performance impact. Since
page poisoning is an opt-in at boot time, there should be no performance
impact by default.

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961#note_53692...

Thanks for the merge.  It looks like the commits were squashed into a
single commit?  It would have been better to preserve the individual
changes.

[Augusto Caringi (via Email Bridge)]

From: Augusto Caringi on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/961#note_53705...

@jpoimboe I agree with you, my mistake.