leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

x86: Enable KASLR by default

Browse Source 
KASLR is mature (and important) enough to be enabled by default on x86.

Also enable it by default in the defconfigs.

Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Baoquan He <bhe@redhat.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: dan.j.williams@intel.com
Cc: dave.jiang@intel.com
Cc: dyoung@redhat.com
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Ingo Molnar 2017-04-18 11:08:12 +02:00
parent f51b17c8d9
commit 6807c84652
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
arch/x86/Kconfig
View File

@ -1966,7 +1966,7 @@ config RELOCATABLE
config RANDOMIZE_BASE config RANDOMIZE_BASE
bool "Randomize the address of the kernel image (KASLR)" bool "Randomize the address of the kernel image (KASLR)"
depends on RELOCATABLE depends on RELOCATABLE
default n default y
---help--- ---help---
In support of Kernel Address Space Layout Randomization (KASLR), In support of Kernel Address Space Layout Randomization (KASLR),
this randomizes the physical address at which the kernel image this randomizes the physical address at which the kernel image
@ -1996,7 +1996,7 @@ config RANDOMIZE_BASE
theoretically possible, but the implementations are further theoretically possible, but the implementations are further
limited due to memory layouts. limited due to memory layouts.
If unsure, say N. If unsure, say Y.
# Relocation on x86 needs some additional build support # Relocation on x86 needs some additional build support
config X86_NEED_RELOCS config X86_NEED_RELOCS
@ -2045,7 +2045,7 @@ config RANDOMIZE_MEMORY
configuration have in average 30,000 different possible virtual configuration have in average 30,000 different possible virtual
addresses for each memory section. addresses for each memory section.
If unsure, say N. If unsure, say Y.
config RANDOMIZE_MEMORY_PHYSICAL_PADDING config RANDOMIZE_MEMORY_PHYSICAL_PADDING
hex "Physical memory mapping padding" if EXPERT hex "Physical memory mapping padding" if EXPERT

2
arch/x86/configs/i386_defconfig
View File

@ -57,6 +57,8 @@ CONFIG_EFI=y
CONFIG_HZ_1000=y CONFIG_HZ_1000=y
CONFIG_KEXEC=y CONFIG_KEXEC=y
CONFIG_CRASH_DUMP=y CONFIG_CRASH_DUMP=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_RANDOMIZE_MEMORY=y
# CONFIG_COMPAT_VDSO is not set # CONFIG_COMPAT_VDSO is not set
CONFIG_HIBERNATION=y CONFIG_HIBERNATION=y
CONFIG_PM_DEBUG=y CONFIG_PM_DEBUG=y

2
arch/x86/configs/x86_64_defconfig
View File

@ -55,6 +55,8 @@ CONFIG_EFI=y
CONFIG_HZ_1000=y CONFIG_HZ_1000=y
CONFIG_KEXEC=y CONFIG_KEXEC=y
CONFIG_CRASH_DUMP=y CONFIG_CRASH_DUMP=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_RANDOMIZE_MEMORY=y
# CONFIG_COMPAT_VDSO is not set # CONFIG_COMPAT_VDSO is not set
CONFIG_HIBERNATION=y CONFIG_HIBERNATION=y
CONFIG_PM_DEBUG=y CONFIG_PM_DEBUG=y