diff options
| author | Ingo Molnar <mingo@kernel.org> | 2018-03-12 14:10:03 +0300 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2018-03-12 14:10:03 +0300 |
| commit | 3c76db70eb70a0fbd40b3e0dec8f69ca344d1ff8 (patch) | |
| tree | a9dd314ac18992cdc2c50d4de60535a1b76ee351 /arch/x86/Kconfig | |
| parent | 194a9749c73d650c0b1dfdee04fb0bdf0a888ba8 (diff) | |
| parent | 7958b2246fadf54b7ff820a2a5a2c5ca1554716f (diff) | |
| download | linux-3c76db70eb70a0fbd40b3e0dec8f69ca344d1ff8.tar.xz | |
Merge branch 'x86/pti' into x86/mm, to pick up dependencies
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'arch/x86/Kconfig')
| -rw-r--r-- | arch/x86/Kconfig | 12 |
1 files changed, 2 insertions, 10 deletions
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 552b3d0eae36..18233e459bff 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -430,6 +430,7 @@ config GOLDFISH config RETPOLINE bool "Avoid speculative indirect branches in kernel" default y + select STACK_VALIDATION if HAVE_STACK_VALIDATION help Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks by avoiding speculative indirect @@ -2315,7 +2316,7 @@ choice it can be used to assist security vulnerability exploitation. This setting can be changed at boot time via the kernel command - line parameter vsyscall=[native|emulate|none]. + line parameter vsyscall=[emulate|none]. On a system with recent enough glibc (2.14 or newer) and no static binaries, you can say None without a performance penalty @@ -2323,15 +2324,6 @@ choice If unsure, select "Emulate". - config LEGACY_VSYSCALL_NATIVE - bool "Native" - help - Actual executable code is located in the fixed vsyscall - address mapping, implementing time() efficiently. Since - this makes the mapping executable, it can be used during - security vulnerability exploitation (traditionally as - ROP gadgets). This configuration is not recommended. - config LEGACY_VSYSCALL_EMULATE bool "Emulate" help |