domenico/openwrt-R7800-nss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel: Enable CONFIG_ARM64_PAN to restrict kernel access to user space memory

Browse Source 
Enable the CONFIG_ARM64_PAN kernel security option, which leverages the
ARMv8.1 Privileged Access Never (PAN) extension to prevent the kernel
from directly accessing user space memory.

Instead, copy_to_user and similar functions must be used for data
transfer between kernel and user space. This feature is automatically
disabled at runtime on CPUs without PAN support, making it a no-op in
those cases.

Link: https://github.com/openwrt/openwrt/pull/16189
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Hauke Mehrtens
2024-08-17 15:12:31 +02:00
parent fd6ce0dea9
commit a2662309aa
10 changed files with 3 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
target/linux/generic/config-5.15
View File

@@ -349,7 +349,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
# CONFIG_ARM64_LSE_ATOMICS is not set
CONFIG_ARM64_MODULE_PLTS=y
# CONFIG_ARM64_MTE is not set
# CONFIG_ARM64_PAN is not set
CONFIG_ARM64_PAN=y
# CONFIG_ARM64_PMEM is not set
# CONFIG_ARM64_PSEUDO_NMI is not set
# CONFIG_ARM64_PTDUMP_DEBUGFS is not set

2
target/linux/generic/config-6.1
View File

@@ -383,7 +383,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
# CONFIG_ARM64_LSE_ATOMICS is not set
CONFIG_ARM64_MODULE_PLTS=y
# CONFIG_ARM64_MTE is not set
# CONFIG_ARM64_PAN is not set
CONFIG_ARM64_PAN=y
# CONFIG_ARM64_PMEM is not set
# CONFIG_ARM64_PSEUDO_NMI is not set
# CONFIG_ARM64_PTDUMP_DEBUGFS is not set

2
target/linux/generic/config-6.6
View File

@@ -358,7 +358,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
# CONFIG_ARM64_HW_AFDBM is not set
# CONFIG_ARM64_LSE_ATOMICS is not set
# CONFIG_ARM64_MTE is not set
# CONFIG_ARM64_PAN is not set
CONFIG_ARM64_PAN=y
# CONFIG_ARM64_PMEM is not set
# CONFIG_ARM64_PSEUDO_NMI is not set
# CONFIG_ARM64_PTR_AUTH is not set