Merge tag 'afs-next-20180208' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowel...

[linux-2.6-block.git] / security / Kconfig

diff --git a/security/Kconfig b/security/Kconfig
index 3d4debd0257e2544996ac97c90831bde3a854e7d..c4302067a3ad2f3568c7aa831f1402fbc7d0903c 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -63,7 +63,7 @@ config PAGE_TABLE_ISOLATION
          ensuring that the majority of kernel addresses are not mapped
          into userspace.
 
-         See Documentation/x86/pagetable-isolation.txt for more details.
+         See Documentation/x86/pti.txt for more details.
 
 config SECURITY_INFINIBAND
        bool "Infiniband Security Hooks"
@@ -154,6 +154,7 @@ config HARDENED_USERCOPY
        bool "Harden memory copies between kernel and userspace"
        depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
        select BUG
+       imply STRICT_DEVMEM
        help
          This option checks for obviously wrong memory regions when
          copying memory to/from the kernel (via copy_to_user() and
@@ -163,6 +164,20 @@ config HARDENED_USERCOPY
          or are part of the kernel text. This kills entire classes
          of heap overflow exploits and similar kernel memory exposures.
 
+config HARDENED_USERCOPY_FALLBACK
+       bool "Allow usercopy whitelist violations to fallback to object size"
+       depends on HARDENED_USERCOPY
+       default y
+       help
+         This is a temporary option that allows missing usercopy whitelists
+         to be discovered via a WARN() to the kernel log, instead of
+         rejecting the copy, falling back to non-whitelisted hardened
+         usercopy that checks the slab allocation size instead of the
+         whitelist size. This option will be removed once it seems like
+         all missing usercopy whitelists have been identified and fixed.
+         Booting with "slab_common.usercopy_fallback=Y/N" can change
+         this setting.
+
 config HARDENED_USERCOPY_PAGESPAN
        bool "Refuse to copy allocations that span multiple pages"
        depends on HARDENED_USERCOPY