diff options
| author | Mel Gorman <mgorman@techsingularity.net> | 2025-01-23 22:11:15 +0000 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2025-02-28 11:51:31 -0800 |
| commit | ca758b147e75f4b564225065d70b6526477185ce (patch) | |
| tree | f488765e3c606d9f6804d6d539cdb0f93c7cab70 /security | |
| parent | 496d2d23886436f7c651bf4c14950eb002815c61 (diff) | |
| download | linux-ca758b147e75f4b564225065d70b6526477185ce.tar.gz linux-ca758b147e75f4b564225065d70b6526477185ce.tar.bz2 linux-ca758b147e75f4b564225065d70b6526477185ce.zip | |
fortify: Move FORTIFY_SOURCE under 'Kernel hardening options'
FORTIFY_SOURCE is a hardening option both at build and runtime. Move
it under 'Kernel hardening options'.
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250123221115.19722-5-mgorman@techsingularity.net
Signed-off-by: Kees Cook <kees@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/Kconfig | 9 | ||||
| -rw-r--r-- | security/Kconfig.hardening | 9 |
2 files changed, 9 insertions, 9 deletions
diff --git a/security/Kconfig b/security/Kconfig index 38ad111e07d0..536061cf33a9 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -164,15 +164,6 @@ config LSM_MMAP_MIN_ADDR this low address space will need the permission specific to the systems running LSM. -config FORTIFY_SOURCE - bool "Harden common str/mem functions against buffer overflows" - depends on ARCH_HAS_FORTIFY_SOURCE - # https://github.com/llvm/llvm-project/issues/53645 - depends on !CC_IS_CLANG || !X86_32 - help - Detect overflows of buffers in common string and memory functions - where the compiler can determine and validate the buffer sizes. - config STATIC_USERMODEHELPER bool "Force all usermode helper calls through a single binary" help diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index 45748379f896..23ffb0d7c845 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -282,6 +282,15 @@ endmenu menu "Bounds checking" +config FORTIFY_SOURCE + bool "Harden common str/mem functions against buffer overflows" + depends on ARCH_HAS_FORTIFY_SOURCE + # https://github.com/llvm/llvm-project/issues/53645 + depends on !CC_IS_CLANG || !X86_32 + help + Detect overflows of buffers in common string and memory functions + where the compiler can determine and validate the buffer sizes. + config HARDENED_USERCOPY bool "Harden memory copies between kernel and userspace" imply STRICT_DEVMEM |