commit a4bd268a233db3443fd08f352f7527405177725d
author Joel Stanley <joel@jms.id.au> Mon Jan 20 13:03:46 2020 +1000
committer Joel Stanley <joel@jms.id.au> Fri Jan 24 16:07:03 2020 +1030
tree 6f511bb39eea2fbfd6331c365448148559cd181d
parent f4126d99829d195c9cba20a871ebdd1a6f95586e

kernel: Enable security options

These options were posted on the linuxppc-dev mailing list[1]:

    Note BUG_ON_DATA_CORRUPTION selects DEBUG_LIST and is essentially just
    a synonym for it.

    DEBUG_SG, DEBUG_NOTIFIERS, DEBUG_LIST, DEBUG_CREDENTIALS and
    SCHED_STACK_END_CHECK should all be low overhead and just add a few
    extra checks.

    Unselecting SLAB_MERGE_DEFAULT causes the SLAB to use more memory, but
    the skiroot kernel shouldn't be memory constrained on any of our
    systems, all it does is run a small bootloader.

    SLAB_FREELIST_RANDOM, and SLUB_DEBUG_ON will add some overhead to the
    SLAB allocator, but nothing that should be meaningful for skiroot.

    Disable xmon default: if the skiroot kernel crashes we don't want it
    sitting at an xmon prompt forever. Instead it's more helpful to
    reboot and bring the boot loader back up, and if the crash was
    transient we can then boot successfully.

    If we panic we should reboot, with a short timeout in case someone
    is watching the console.

    Turn on HARDENED_USERCOPY with HARDENED_USERCOPY_PAGESPAN, and
    FORTIFY_SOURCE.

    It also enables SECURITY_LOCKDOWN_LSM with _EARLY.

    MODULE_SIG is selected by lockdown, so it is still enabled.

    Drop default n CONFIG_CRYPTO_ECHAINIV

    Drop HID_LOGITECH

    Drop NET_VENDOR_HP which moved to staging

    NET_CADENCE became NET_VENDOR_CADENCE

    Drop CONFIG_QLGE which moved to staging

[1] https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=153437

Note that this commit does not include the change to set
LOCK_DOWN_KERNEL_FORCE_INTEGRITY, as this causes the kernel to lock down
the kexec system call.

kexec_file is enabled, and can be tested by manually running kexec with
the -s option instead of -l. Integrity mode can then be enabled by
setting the command line lockdown={integrity|confidentiality}.

 nvram -p ibm,skiboot --update-config bootargs="lockdown=integrity"

Enabling FORCE_INTEGRITY in the kernel is deferred to a later date when
petitboot has gained support for using kexec_file.

Signed-off-by: Joel Stanley <joel@jms.id.au>