Skip to content

security(kernel): enable hardening config defaults #16714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rlmenge wants to merge 5 commits into
base: tomls/base/main
Choose a base branch
from
+20 −20
Open

security(kernel): enable hardening config defaults #16714

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
391c8b2
security(kernel): enable kernel data-structure corruption detection
rlmenge Apr 16, 2026
58d0e57
security(kernel): disable slab cache merging by default
rlmenge Apr 16, 2026
83e91bf
security(kernel): enable CET/IBT and remove legacy vsyscall on x86_64
rlmenge Apr 16, 2026
c2f4107
security(kernel): LSM mmap floor on x86_64, SMMU default-deny on aarch64
rlmenge Apr 16, 2026
bdfb314
kernel: bump azl_pkgrelease to 9 for hardening changes
rlmenge Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions base/comps/kernel/6.18-aarch64-azl.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1179,7 +1179,7 @@ CONFIG_ZSMALLOC_CHAIN_SIZE=8
CONFIG_SLUB=y
CONFIG_KVFREE_RCU_BATCHED=y
# CONFIG_SLUB_TINY is not set
CONFIG_SLAB_MERGE_DEFAULT=y
# CONFIG_SLAB_MERGE_DEFAULT is not set
CONFIG_SLAB_FREELIST_RANDOM=y
CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_SLAB_BUCKETS=y
Expand Down Expand Up @@ -11226,7 +11226,7 @@ CONFIG_IOMMU_SVA=y
CONFIG_IOMMU_IOPF=y
CONFIG_ARM_SMMU=y
# CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
# CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT is not set
CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT=y
CONFIG_ARM_SMMU_MMU_500_CPRE_ERRATA=y
CONFIG_ARM_SMMU_QCOM=y
# CONFIG_ARM_SMMU_QCOM_DEBUG is not set
Expand Down Expand Up @@ -13538,8 +13538,8 @@ CONFIG_HARDENED_USERCOPY_DEFAULT_ON=y
#
# Hardening of kernel data structures
#
# CONFIG_LIST_HARDENED is not set
# CONFIG_BUG_ON_DATA_CORRUPTION is not set
CONFIG_LIST_HARDENED=y
CONFIG_BUG_ON_DATA_CORRUPTION=y
Comment on lines +13541 to +13542
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description calls out setting an LSM mmap floor (CONFIG_LSM_MMAP_MIN_ADDR=65536), but the aarch64 config still leaves CONFIG_LSM_MMAP_MIN_ADDR=0 (see file contents around line ~13413). If the hardening is intended for all arches, this should be updated in the aarch64 config as well; if it’s intentionally x86_64-only, please clarify that in the PR description/commit message.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

@rlmenge rlmenge Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good callout. 3.0 uses CONFIG_LSM_MMAP_MIN_ADDR=4096 for arm64

# end of Hardening of kernel data structures

# CONFIG_CFI is not set
Expand Down Expand Up @@ -14307,10 +14307,10 @@ CONFIG_STACKTRACE=y
#
# Debug kernel data structures
#
# CONFIG_DEBUG_LIST is not set
# CONFIG_DEBUG_PLIST is not set
# CONFIG_DEBUG_SG is not set
# CONFIG_DEBUG_NOTIFIERS is not set
CONFIG_DEBUG_LIST=y
CONFIG_DEBUG_PLIST=y
Copy link
Copy Markdown
Collaborator

@christopherco christopherco Apr 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: commit message indicates DEBUG_LIST, DEBUG_PLIST, DEBUG_SG, DEBUG_NOTIFIERS are enabled due to LIST_HARDENED and BUG_ON_DATA_CORRUPTION, but that doesn't look accurate from looking at the Kconfig selectors upstream:

security(kernel): enable kernel data-structure corruption detection
Enable LIST_HARDENED and BUG_ON_DATA_CORRUPTION on both x86_64 and
aarch64, which pulls in DEBUG_LIST, DEBUG_PLIST, DEBUG_SG, and
DEBUG_NOTIFIERS. Kernel panics on detected list-head/scatterlist/
notifier/credential corruption; KSPP recommended.

Can you clarify how these 4 DEBUG_* are being force-enabled? Do they help with enabling these other hardening configurations?

Note: I also do worry about performance penalty with the DEBUG options. But we should iterate on this with perf data to understand how much we're trading off for what we gain.

Copy link
Copy Markdown
Contributor Author

@rlmenge rlmenge Apr 20, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack. We for sure want LIST_HARDENED as that has been beneficial in the past. I will confirm whether the DEBUG_* are also needed. I did check prior to this PR and they are enabled in our 3.0 offering except for DEBUG_PLIST.

CONFIG_DEBUG_SG=y
CONFIG_DEBUG_NOTIFIERS=y
# CONFIG_DEBUG_CLOSURES is not set
# CONFIG_DEBUG_MAPLE_TREE is not set
# end of Debug kernel data structures
Expand Down
22 changes: 11 additions & 11 deletions base/comps/kernel/6.18-x86_64-azl.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -493,7 +493,7 @@ CONFIG_X86_PAT=y
CONFIG_X86_UMIP=y
CONFIG_CC_HAS_IBT=y
CONFIG_X86_CET=y
# CONFIG_X86_KERNEL_IBT is not set
CONFIG_X86_KERNEL_IBT=y
CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
CONFIG_ARCH_PKEY_BITS=4
CONFIG_X86_INTEL_TSX_MODE_OFF=y
Expand Down Expand Up @@ -535,8 +535,8 @@ CONFIG_RANDOMIZE_MEMORY=y
CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa
CONFIG_HOTPLUG_CPU=y
# CONFIG_COMPAT_VDSO is not set
CONFIG_LEGACY_VSYSCALL_XONLY=y
# CONFIG_LEGACY_VSYSCALL_NONE is not set
# CONFIG_LEGACY_VSYSCALL_XONLY is not set
CONFIG_LEGACY_VSYSCALL_NONE=y
# CONFIG_CMDLINE_BOOL is not set
CONFIG_MODIFY_LDT_SYSCALL=y
# CONFIG_STRICT_SIGALTSTACK_SIZE is not set
Expand Down Expand Up @@ -1195,7 +1195,7 @@ CONFIG_ZSMALLOC_CHAIN_SIZE=8
CONFIG_SLUB=y
CONFIG_KVFREE_RCU_BATCHED=y
# CONFIG_SLUB_TINY is not set
CONFIG_SLAB_MERGE_DEFAULT=y
# CONFIG_SLAB_MERGE_DEFAULT is not set
CONFIG_SLAB_FREELIST_RANDOM=y
CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_SLAB_BUCKETS=y
Expand Down Expand Up @@ -7536,7 +7536,7 @@ CONFIG_SECURITY_INFINIBAND=y
CONFIG_SECURITY_NETWORK_XFRM=y
CONFIG_SECURITY_PATH=y
CONFIG_INTEL_TXT=y
CONFIG_LSM_MMAP_MIN_ADDR=0
CONFIG_LSM_MMAP_MIN_ADDR=65536
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
Expand Down Expand Up @@ -7666,8 +7666,8 @@ CONFIG_HARDENED_USERCOPY_DEFAULT_ON=y
#
# Hardening of kernel data structures
#
# CONFIG_LIST_HARDENED is not set
# CONFIG_BUG_ON_DATA_CORRUPTION is not set
CONFIG_LIST_HARDENED=y
CONFIG_BUG_ON_DATA_CORRUPTION=y
# end of Hardening of kernel data structures

# CONFIG_CFI is not set
Expand Down Expand Up @@ -8353,10 +8353,10 @@ CONFIG_STACKTRACE=y
#
# Debug kernel data structures
#
# CONFIG_DEBUG_LIST is not set
# CONFIG_DEBUG_PLIST is not set
# CONFIG_DEBUG_SG is not set
# CONFIG_DEBUG_NOTIFIERS is not set
CONFIG_DEBUG_LIST=y
CONFIG_DEBUG_PLIST=y
CONFIG_DEBUG_SG=y
CONFIG_DEBUG_NOTIFIERS=y
# CONFIG_DEBUG_CLOSURES is not set
# CONFIG_DEBUG_MAPLE_TREE is not set
# end of Debug kernel data structures
Expand Down
2 changes: 1 addition & 1 deletion base/comps/kernel/kernel.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ without = ["debug"]

[components.kernel.build.defines]
# RPM release number for the Azure Linux kernel package
azl_pkgrelease = "8"
azl_pkgrelease = "9"
# 4th version component from the AZL kernel source (6.18.5.1). Included in specrelease so it appears
# in the RPM Release tag, uname -r, and /lib/modules/ path (e.g. 6.18.5-1.3.azl4.aarch64).
Comment thread
rlmenge marked this conversation as resolved.
kextraversion = "1"
Expand Down
Loading