summaryrefslogtreecommitdiff
blob: 6d61fd015a02f6f39c28d3a48859ab32f0e391aa (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
From: Anthony G. Basile <blueness@gentoo.org>
From: Gordon Malm <gengor@gentoo.org>
From: Jory A. Pratt <anarchy@gentoo.org>
From: Kerin Millar <kerframil@gmail.com>

Add Hardened Gentoo [server/workstation] predefined grsecurity
levels. They're designed to provide a comparitively high level of
security while remaining generally suitable for as great a majority
of the userbase as possible (particularly new users).

Make Hardened Gentoo [workstation] predefined grsecurity level the
default. The Hardened Gentoo [server] level is more restrictive
and conflicts with some software and thus would be less suitable.

The original version of this patch was conceived and created by:
Ned Ludd <solar@gentoo.org>

diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-hardened-r44/grsecurity/Kconfig
--- linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig	2011-04-17 18:41:22.000000000 -0400
+++ linux-2.6.32-hardened-r44/grsecurity/Kconfig	2011-04-17 18:42:14.000000000 -0400
@@ -18,7 +18,7 @@
 choice
 	prompt "Security Level"
 	depends on GRKERNSEC
-	default GRKERNSEC_CUSTOM
+	default GRKERNSEC_HARDENED_WORKSTATION
 
 config GRKERNSEC_LOW
 	bool "Low"
@@ -195,6 +195,261 @@
 	  - Restricted sysfs/debugfs
 	  - Active kernel exploit response
 
+config GRKERNSEC_HARDENED_SERVER
+	bool "Hardened Gentoo [server]"
+	select GRKERNSEC_LINK
+	select GRKERNSEC_FIFO
+	select GRKERNSEC_EXECVE
+	select GRKERNSEC_DMESG
+	select GRKERNSEC_FORKFAIL
+	select GRKERNSEC_TIME
+	select GRKERNSEC_SIGNAL
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_SHMAT
+	select GRKERNSEC_CHROOT_UNIX
+	select GRKERNSEC_CHROOT_MOUNT
+	select GRKERNSEC_CHROOT_FCHDIR
+	select GRKERNSEC_CHROOT_PIVOT
+	select GRKERNSEC_CHROOT_DOUBLE
+	select GRKERNSEC_CHROOT_CHDIR
+	select GRKERNSEC_CHROOT_MKNOD
+	select GRKERNSEC_CHROOT_CAPS
+	select GRKERNSEC_CHROOT_SYSCTL
+	select GRKERNSEC_CHROOT_FINDTASK
+	select GRKERNSEC_PROC
+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
+	select GRKERNSEC_HIDESYM
+	select GRKERNSEC_BRUTE
+	select GRKERNSEC_PROC_USERGROUP
+	select GRKERNSEC_KMEM
+	select GRKERNSEC_RESLOG
+	select GRKERNSEC_RANDNET
+	select GRKERNSEC_PROC_ADD
+	select GRKERNSEC_CHROOT_CHMOD
+	select GRKERNSEC_CHROOT_NICE
+	select GRKERNSEC_AUDIT_MOUNT
+	select GRKERNSEC_MODHARDEN if (MODULES)
+	select GRKERNSEC_HARDEN_PTRACE
+	select GRKERNSEC_VM86 if (X86_32)
+	select GRKERNSEC_IO if (X86)
+	select GRKERNSEC_PROC_IPADDR
+	select GRKERNSEC_RWXMAP_LOG
+	select GRKERNSEC_SYSCTL
+	select GRKERNSEC_SYSCTL_ON
+	select PAX
+	select PAX_RANDUSTACK
+	select PAX_ASLR
+	select PAX_RANDMMAP
+	select PAX_NOEXEC
+	select PAX_MPROTECT
+	select PAX_EI_PAX
+	select PAX_PT_PAX_FLAGS
+	select PAX_HAVE_ACL_FLAGS
+	select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
+	select PAX_MEMORY_UDEREF if (X86 && !XEN)
+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
+	select PAX_SEGMEXEC if (X86_32)
+	select PAX_PAGEEXEC
+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
+	select PAX_EMUTRAMP if (PARISC)
+	select PAX_EMUSIGRT if (PARISC)
+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
+	select PAX_REFCOUNT if (X86 || SPARC64)
+	select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
+	select PAX_MEMORY_SANITIZE
+	help
+	  If you say Y here, a configuration for grsecurity/PaX features
+	  will be used that is endorsed by the Hardened Gentoo project.
+	  These pre-defined security levels are designed to provide a high
+	  level of security while minimizing incompatibilities with a majority
+	  of Gentoo's available software.
+
+	  This "Hardened Gentoo [server]" level is identical to the
+	  "Hardened Gentoo [workstation]" level, but with GRKERNSEC_IO,
+	  and GRKERNSEC_PROC_ADD enabled.  Accordingly, this is the preferred
+	  security level if the system will not be utilizing software incompatible
+	  with these features.
+
+	  When this level is selected, some security features will be forced on,
+	  while others will default to their suggested values of off or on.  The
+	  later can be tweaked at the user's discretion, but may cause problems
+	  in some situations.  You can fully customize all grsecurity/PaX features
+	  by choosing "Custom" in the Security Level menu.  It may be helpful to
+	  inherit the options selected by this security level as a starting point.
+	  To accomplish this, select this security level, then exit the menuconfig
+	  interface, saving changes when prompted.  Run make menuconfig again and
+	  select the "Custom" level.
+
+config GRKERNSEC_HARDENED_WORKSTATION
+	bool "Hardened Gentoo [workstation]"
+	select GRKERNSEC_LINK
+	select GRKERNSEC_FIFO
+	select GRKERNSEC_EXECVE
+	select GRKERNSEC_DMESG
+	select GRKERNSEC_FORKFAIL
+	select GRKERNSEC_TIME
+	select GRKERNSEC_SIGNAL
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_SHMAT
+	select GRKERNSEC_CHROOT_UNIX
+	select GRKERNSEC_CHROOT_MOUNT
+	select GRKERNSEC_CHROOT_FCHDIR
+	select GRKERNSEC_CHROOT_PIVOT
+	select GRKERNSEC_CHROOT_DOUBLE
+	select GRKERNSEC_CHROOT_CHDIR
+	select GRKERNSEC_CHROOT_MKNOD
+	select GRKERNSEC_CHROOT_CAPS
+	select GRKERNSEC_CHROOT_SYSCTL
+	select GRKERNSEC_CHROOT_FINDTASK
+	select GRKERNSEC_PROC
+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
+	select GRKERNSEC_HIDESYM
+	select GRKERNSEC_BRUTE
+	select GRKERNSEC_PROC_USERGROUP
+	select GRKERNSEC_KMEM
+	select GRKERNSEC_RESLOG
+	select GRKERNSEC_RANDNET
+	# select GRKERNSEC_PROC_ADD
+	select GRKERNSEC_CHROOT_CHMOD
+	select GRKERNSEC_CHROOT_NICE
+	select GRKERNSEC_AUDIT_MOUNT
+	select GRKERNSEC_MODHARDEN if (MODULES)
+	select GRKERNSEC_HARDEN_PTRACE
+	select GRKERNSEC_VM86 if (X86_32)
+	# select GRKERNSEC_IO if (X86)
+	select GRKERNSEC_PROC_IPADDR
+	select GRKERNSEC_RWXMAP_LOG
+	select GRKERNSEC_SYSCTL
+	select GRKERNSEC_SYSCTL_ON
+	select PAX
+	select PAX_RANDUSTACK
+	select PAX_ASLR
+	select PAX_RANDMMAP
+	select PAX_NOEXEC
+	select PAX_MPROTECT
+	select PAX_EI_PAX
+	select PAX_PT_PAX_FLAGS
+	select PAX_HAVE_ACL_FLAGS
+	# select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
+	# select PAX_MEMORY_UDEREF if (X86 && !XEN)
+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
+	select PAX_SEGMEXEC if (X86_32)
+	select PAX_PAGEEXEC
+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
+	select PAX_EMUTRAMP if (PARISC)
+	select PAX_EMUSIGRT if (PARISC)
+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
+	select PAX_REFCOUNT if (X86 || SPARC64)
+	select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
+	select PAX_MEMORY_SANITIZE
+	help
+	  If you say Y here, a configuration for grsecurity/PaX features
+	  will be used that is endorsed by the Hardened Gentoo project.
+	  These pre-defined security levels are designed to provide a high
+	  level of security while minimizing incompatibilities with a majority
+	  of Gentoo's available software.
+
+	  This "Hardened Gentoo [workstation]" level is identical to the
+	  "Hardened Gentoo [server]" level, but with GRKERNSEC_IO and
+	  GRKERNSEC_PROC_ADD disabled.  Accordingly, this is the preferred
+	  security level if the system will be utilizing software incompatible
+	  with these features.
+
+	  When this level is selected, some security features will be forced on,
+	  while others will default to their suggested values of off or on.  The
+	  later can be tweaked at the user's discretion, but may cause problems
+	  in some situations.  You can fully customize all grsecurity/PaX features
+	  by choosing "Custom" in the Security Level menu.  It may be helpful to
+	  inherit the options selected by this security level as a starting point.
+	  To accomplish this, select this security level, then exit the menuconfig
+	  interface, saving changes when prompted.  Run make menuconfig again and
+	  select the "Custom" level.
+
+config GRKERNSEC_HARDENED_VIRTUALIZATION
+	bool "Hardened Gentoo [virtualization]"
+	select GRKERNSEC_LINK
+	select GRKERNSEC_FIFO
+	select GRKERNSEC_EXECVE
+	select GRKERNSEC_DMESG
+	select GRKERNSEC_FORKFAIL
+	select GRKERNSEC_TIME
+	select GRKERNSEC_SIGNAL
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_SHMAT
+	select GRKERNSEC_CHROOT_UNIX
+	select GRKERNSEC_CHROOT_MOUNT
+	select GRKERNSEC_CHROOT_FCHDIR
+	select GRKERNSEC_CHROOT_PIVOT
+	select GRKERNSEC_CHROOT_DOUBLE
+	select GRKERNSEC_CHROOT_CHDIR
+	select GRKERNSEC_CHROOT_MKNOD
+	select GRKERNSEC_CHROOT_CAPS
+	select GRKERNSEC_CHROOT_SYSCTL
+	select GRKERNSEC_CHROOT_FINDTASK
+	select GRKERNSEC_PROC
+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
+	select GRKERNSEC_HIDESYM
+	select GRKERNSEC_BRUTE
+	select GRKERNSEC_PROC_USERGROUP
+	select GRKERNSEC_KMEM
+	select GRKERNSEC_RESLOG
+	select GRKERNSEC_RANDNET
+	# select GRKERNSEC_PROC_ADD
+	select GRKERNSEC_CHROOT_CHMOD
+	select GRKERNSEC_CHROOT_NICE
+	select GRKERNSEC_AUDIT_MOUNT
+	select GRKERNSEC_MODHARDEN if (MODULES)
+	select GRKERNSEC_HARDEN_PTRACE
+	select GRKERNSEC_VM86 if (X86_32)
+	# select GRKERNSEC_IO if (X86)
+	select GRKERNSEC_PROC_IPADDR
+	select GRKERNSEC_RWXMAP_LOG
+	select GRKERNSEC_SYSCTL
+	select GRKERNSEC_SYSCTL_ON
+	select PAX
+	select PAX_RANDUSTACK
+	select PAX_ASLR
+	select PAX_RANDMMAP
+	select PAX_NOEXEC
+	select PAX_MPROTECT
+	select PAX_EI_PAX
+	select PAX_PT_PAX_FLAGS
+	select PAX_HAVE_ACL_FLAGS
+	# select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
+	# select PAX_MEMORY_UDEREF if (X86 && !XEN)
+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
+	select PAX_SEGMEXEC if (X86_32)
+	select PAX_PAGEEXEC
+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
+	select PAX_EMUTRAMP if (PARISC)
+	select PAX_EMUSIGRT if (PARISC)
+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
+	select PAX_REFCOUNT if (X86 || SPARC64)
+	select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
+	select PAX_MEMORY_SANITIZE
+	help
+	  If you say Y here, a configuration for grsecurity/PaX features
+	  will be used that is endorsed by the Hardened Gentoo project.
+	  These pre-defined security levels are designed to provide a high
+	  level of security while minimizing incompatibilities with a majority
+	  of Gentoo's available software.
+
+	  This "Hardened Gentoo [virtualization]" level is identical to the
+	  "Hardened Gentoo [workstation]" level, but with the PAX_KERNEXEC and
+	  PAX_MEMORY_UDEREF defaulting to off.  Accordingly, this is the preferred
+	  security level if the system will be utilizing virtualization software
+	  incompatible with these features, like VirtualBox or kvm.
+
+	  When this level is selected, some security features will be forced on,
+	  while others will default to their suggested values of off or on.  The
+	  later can be tweaked at the user's discretion, but may cause problems
+	  in some situations.  You can fully customize all grsecurity/PaX features
+	  by choosing "Custom" in the Security Level menu.  It may be helpful to
+	  inherit the options selected by this security level as a starting point.
+	  To accomplish this, select this security level, then exit the menuconfig
+	  interface, saving changes when prompted.  Run make menuconfig again and
+	  select the "Custom" level.
+
 config GRKERNSEC_CUSTOM
 	bool "Custom"
 	help
diff -Naur linux-2.6.32-hardened-r44.orig/security/Kconfig linux-2.6.32-hardened-r44/security/Kconfig
--- linux-2.6.32-hardened-r44.orig/security/Kconfig	2011-04-17 18:36:55.000000000 -0400
+++ linux-2.6.32-hardened-r44/security/Kconfig	2011-04-17 18:42:14.000000000 -0400
@@ -319,8 +319,9 @@
 
 config PAX_KERNEXEC
 	bool "Enforce non-executable kernel pages"
-	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
+	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION
 	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
+	default y if GRKERNSEC_HARDENED_WORKSTATION
 	help
 	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
 	  that is, enabling this option will make it harder to inject
@@ -476,8 +477,9 @@
 
 config PAX_MEMORY_UDEREF
 	bool "Prevent invalid userland pointer dereference"
-	depends on X86 && !UML_X86 && !XEN
+	depends on X86 && !UML_X86 && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION
 	select PAX_PER_CPU_PGD if X86_64
+	default y if GRKERNSEC_HARDENED_WORKSTATION
 	help
 	  By saying Y here the kernel will be prevented from dereferencing
 	  userland pointers in contexts where the kernel expects only kernel