Code

Disable TCP simultaneous connect#24

Code

Closed

madaidan wants to merge 108 commits intoanthraxx:masteranthraxx/linux-hardened:masterfrom madaidan:tcp_simult_connectmadaidan/linux-hardened:tcp_simult_connectCopy head branch name to clipboard

+771-275

Commits

Commits on Feb 5, 2020

• make DEFAULT_MMAP_MIN_ADDR match LSM_MMAP_MIN_ADDR

  Show description for 8bc7636
  

  thestinger

  authored and

  anthraxx

  committed
  8bc7636

  Copy full SHA for 8bc7636

• enable HARDENED_USERCOPY by default

  Show description for a8488f5
  

  thestinger

  authored and

  anthraxx

  committed
  a8488f5

  Copy full SHA for a8488f5

• disable HARDENED_USERCOPY_FALLBACK by default

  

  thestinger

  authored and

  anthraxx

  committed
  74df025

  Copy full SHA for 74df025

• enable SECURITY_DMESG_RESTRICT by default

  Show description for 4eb0d58
  

  thestinger

  authored and

  anthraxx

  committed
  4eb0d58

  Copy full SHA for 4eb0d58

• set kptr_restrict=2 by default

  Show description for c51ecd0
  

  thestinger

  authored and

  anthraxx

  committed
  c51ecd0

  Copy full SHA for c51ecd0

• enable DEBUG_LIST by default

  Show description for d4adb1e
  

  thestinger

  authored and

  anthraxx

  committed
  d4adb1e

  Copy full SHA for d4adb1e

• enable BUG_ON_DATA_CORRUPTION by default

  Show description for 1ccc60c
  

  thestinger

  authored and

  anthraxx

  committed
  1ccc60c

  Copy full SHA for 1ccc60c

• enable ARM64_SW_TTBR0_PAN by default

  

  thestinger

  authored and

  anthraxx

  committed
  1d4df4f

  Copy full SHA for 1d4df4f

• arm64: enable RANDOMIZE_BASE by default

  

  thestinger

  authored and

  anthraxx

  committed
  8c8221b

  Copy full SHA for 8c8221b

• enable SLAB_FREELIST_RANDOM by default

  Show description for 522a7a8
  

  thestinger

  authored and

  anthraxx

  committed
  522a7a8

  Copy full SHA for 522a7a8

• enable SLAB_FREELIST_HARDENED by default

  

  thestinger

  authored and

  anthraxx

  committed
  e66a9db

  Copy full SHA for e66a9db

• disable SLAB_MERGE_DEFAULT by default

  

  thestinger

  authored and

  anthraxx

  committed
  a54f690

  Copy full SHA for a54f690

• enable FORTIFY_SOURCE by default

  Show description for 6dc663b
  

  thestinger

  authored and

  anthraxx

  committed
  6dc663b

  Copy full SHA for 6dc663b

• enable PANIC_ON_OOPS by default

  Show description for 1b317c4
  

  thestinger

  authored and

  anthraxx

  committed
  1b317c4

  Copy full SHA for 1b317c4

• stop hiding SLUB_DEBUG behind EXPERT

  Show description for d6c6493
  

  thestinger

  authored and

  anthraxx

  committed
  d6c6493

  Copy full SHA for d6c6493

• stop hiding X86_16BIT behind EXPERT

  

  thestinger

  authored and

  anthraxx

  committed
  3970d13

  Copy full SHA for 3970d13

• disable X86_16BIT by default

  Show description for 3945314
  

  thestinger

  authored and

  anthraxx

  committed
  3945314

  Copy full SHA for 3945314

• stop hiding MODIFY_LDT_SYSCALL behind EXPERT

  

  thestinger

  authored and

  anthraxx

  committed
  8ffec63

  Copy full SHA for 8ffec63

• disable MODIFY_LDT_SYSCALL by default

  Show description for 9d44baa
  

  thestinger

  authored and

  anthraxx

  committed
  9d44baa

  Copy full SHA for 9d44baa

• set LEGACY_VSYSCALL_NONE by default

  

  thestinger

  authored and

  anthraxx

  committed
  f108bf6

  Copy full SHA for f108bf6

• stop hiding AIO behind EXPERT

  

  Bernhard40

  authored and

  anthraxx

  committed
  fd40a80

  Copy full SHA for fd40a80

• disable AIO by default

  

  Bernhard40

  authored and

  anthraxx

  committed
  7b271c4

  Copy full SHA for 7b271c4

• remove SYSVIPC from arm64/x86_64 defconfigs

  

  thestinger

  authored and

  anthraxx

  committed
  08bb496

  Copy full SHA for 08bb496

• disable DEVPORT by default

  

  thestinger

  authored and

  anthraxx

  committed
  c01594f

  Copy full SHA for c01594f

• disable PROC_VMCORE by default

  

  thestinger

  authored and

  anthraxx

  committed
  1373658

  Copy full SHA for 1373658

• disable NFS_DEBUG by default

  

  thestinger

  authored and

  anthraxx

  committed
  b74b828

  Copy full SHA for b74b828

• enable DEBUG_WX by default

  Show description for 3014c2f
  

  thestinger

  authored and

  anthraxx

  committed
  3014c2f

  Copy full SHA for 3014c2f

• disable LEGACY_PTYS by default

  

  thestinger

  authored and

  anthraxx

  committed
  d2c3ec4

  Copy full SHA for d2c3ec4

• disable DEVMEM by default

  

  thestinger

  authored and

  anthraxx

  committed
  a865724

  Copy full SHA for a865724

• enable IO_STRICT_DEVMEM by default

  

  thestinger

  authored and

  anthraxx

  committed
  aaa4557

  Copy full SHA for aaa4557

• disable COMPAT_BRK by default

  

  thestinger

  authored and

  anthraxx

  committed
  cf7b465

  Copy full SHA for cf7b465

• use maximum supported mmap rnd entropy by default

  Show description for 250a7a8
  

  thestinger

  authored and

  anthraxx

  committed
  250a7a8

  Copy full SHA for 250a7a8

• enable protected_{symlinks,hardlinks} by default

  

  thestinger

  authored and

  anthraxx

  committed
  63ee9bb

  Copy full SHA for 63ee9bb

• enable SECURITY by default

  

  thestinger

  authored and

  anthraxx

  committed
  e400d98

  Copy full SHA for e400d98

• enable SECURITY_YAMA by default

  

  thestinger

  authored and

  anthraxx

  committed
  b9c3132

  Copy full SHA for b9c3132

• enable SECURITY_NETWORK by default

  

  thestinger

  authored and

  anthraxx

  committed
  e915334

  Copy full SHA for e915334

• enable AUDIT by default

  

  thestinger

  authored and

  anthraxx

  committed
  128adb0

  Copy full SHA for 128adb0

• enable SECURITY_SELINUX by default

  

  thestinger

  authored and

  anthraxx

  committed
  9a82a14

  Copy full SHA for 9a82a14

• enable SYN_COOKIES by default

  

  thestinger

  authored and

  anthraxx

  committed
  982fabd

  Copy full SHA for 982fabd

• add __read_only for non-init related usage

  

  thestinger

  authored and

  anthraxx

  committed
  a32a012

  Copy full SHA for a32a012

• make sysctl constants read-only

  Show description for 3c64c49
  

  thestinger

  authored and

  anthraxx

  committed
  3c64c49

  Copy full SHA for 3c64c49

• mark kernel_set_to_readonly as __ro_after_init

  Show description for 6394f49
  

  thestinger

  authored and

  anthraxx

  committed
  6394f49

  Copy full SHA for 6394f49

• mark slub runtime configuration as __ro_after_init

  Show description for 9682c78
  

  thestinger

  authored and

  anthraxx

  committed
  9682c78

  Copy full SHA for 9682c78

• add __ro_after_init to slab_nomerge and slab_state

  Show description for 659c806
  

  thestinger

  authored and

  anthraxx

  committed
  659c806

  Copy full SHA for 659c806

• mark kmem_cache as __ro_after_init

  

  thestinger

  authored and

  anthraxx

  committed
  c2668ce

  Copy full SHA for c2668ce

• mark __supported_pte_mask as __ro_after_init

  Show description for 080a508
  

  thestinger

  authored and

  anthraxx

  committed
  080a508

  Copy full SHA for 080a508

• mark kobj_ns_type_register as only used for init

  Show description for 12b1e2a
  

  thestinger

  authored and

  anthraxx

  committed
  12b1e2a

  Copy full SHA for 12b1e2a

• mark open_softirq as only used for init

  

  thestinger

  authored and

  anthraxx

  committed
  9e3cfd8

  Copy full SHA for 9e3cfd8

• remove unused softirq_action callback parameter

  Show description for 114a072
  

  thestinger

  authored and

  anthraxx

  committed
  114a072

  Copy full SHA for 114a072

• mark softirq_vec as __ro_after_init

  Show description for 983d7af
  

  thestinger

  authored and

  anthraxx

  committed
  983d7af

  Copy full SHA for 983d7af

• mm: slab: trigger BUG if requested object is not a slab page

  Show description for dd112cf
  

  thestinger

  authored and

  anthraxx

  committed
  dd112cf

  Copy full SHA for dd112cf

• bug on kmem_cache_free with the wrong cache

  Show description for 1d286a3
  

  thestinger

  authored and

  anthraxx

  committed
  1d286a3

  Copy full SHA for 1d286a3

• bug on !PageSlab && !PageCompound in ksize

  Show description for da2673e
  

  thestinger

  authored and

  anthraxx

  committed
  da2673e

  Copy full SHA for da2673e

• mm: add support for verifying page sanitization

  Show description for bf7150e
  

  thestinger

  authored and

  anthraxx

  committed
  bf7150e

  Copy full SHA for bf7150e

• slub: Extend init_on_free to slab caches with constructors

  Show description for 2c095f3
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  2c095f3

  Copy full SHA for 2c095f3

• slub: Add support for verifying slab sanitization

  Show description for 9458c89
  

  thestinger

  authored and

  anthraxx

  committed
  9458c89

  Copy full SHA for 9458c89

• slub: add multi-purpose random canaries

  Show description for 2ce1956
  

  thestinger

  authored and

  anthraxx

  committed
  2ce1956

  Copy full SHA for 2ce1956

• security,perf: Allow further restriction of perf_event_open

  Show description for 468095d
  

  bwhacks

  authored and

  anthraxx

  committed
  468095d

  Copy full SHA for 468095d

• enable SECURITY_PERF_EVENTS_RESTRICT by default

  Show description for 99a3330
  

  thestinger

  authored and

  anthraxx

  committed
  99a3330

  Copy full SHA for 99a3330

• add sysctl to disallow unprivileged CLONE_NEWUSER by default

  Show description for f5058d9
  

  hallyn

  authored and

  anthraxx

  committed
  f5058d9

  Copy full SHA for f5058d9

• add kmalloc/krealloc alloc_size attributes

  Show description for ec73ebd
  

  thestinger

  authored and

  anthraxx

  committed
  ec73ebd

  Copy full SHA for ec73ebd

• add vmalloc alloc_size attributes

  Show description for 533c43f
  

  thestinger

  authored and

  anthraxx

  committed
  533c43f

  Copy full SHA for 533c43f

• add kvmalloc alloc_size attribute

  Show description for fe1765f
  

  thestinger

  authored and

  anthraxx

  committed
  fe1765f

  Copy full SHA for fe1765f

• add percpu alloc_size attributes

  Show description for eee3fa3
  

  thestinger

  authored and

  anthraxx

  committed
  eee3fa3

  Copy full SHA for eee3fa3

• add alloc_pages_exact alloc_size attributes

  Show description for 694cbc9
  

  thestinger

  authored and

  anthraxx

  committed
  694cbc9

  Copy full SHA for 694cbc9

• Add the extra_latent_entropy kernel parameter

  Show description for 0ca98c2
  

  ephox-gcc-plugins

  authored and

  anthraxx

  committed
  0ca98c2

  Copy full SHA for 0ca98c2

• ata: avoid null pointer dereference on bug

  Show description for ecbd814
  

  thestinger

  authored and

  anthraxx

  committed
  ecbd814

  Copy full SHA for ecbd814

• sanity check for negative length in nla_memcpy

  Show description for 14c10d0
  

  thestinger

  authored and

  anthraxx

  committed
  14c10d0

  Copy full SHA for 14c10d0

• add page destructor sanity check

  Show description for 5cc8adb
  

  thestinger

  authored and

  anthraxx

  committed
  5cc8adb

  Copy full SHA for 5cc8adb

• PaX shadow cr4 sanity check (essentially a revert)

  Show description for 6973f4b
  

  thestinger

  authored and

  anthraxx

  committed
  6973f4b

  Copy full SHA for 6973f4b

• add writable function pointer detection

  Show description for eaa87f6
  

  thestinger

  authored and

  anthraxx

  committed
  eaa87f6

  Copy full SHA for eaa87f6

• support overriding early audit kernel cmdline

  

  thestinger

  authored and

  anthraxx

  committed
  5639af8

  Copy full SHA for 5639af8

• FORTIFY_SOURCE intra-object overflow checking

  Show description for 8cc6f2c
  

  thestinger

  authored and

  anthraxx

  committed
  8cc6f2c

  Copy full SHA for 8cc6f2c

• Revert "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes"

  Show description for 224b56e
  

  thestinger

  authored and

  anthraxx

  committed
  224b56e

  Copy full SHA for 224b56e

• x86_64: move vdso to mmap region from stack region

  Show description for 5bcddc9
  

  thestinger

  authored and

  anthraxx

  committed
  5bcddc9

  Copy full SHA for 5bcddc9

• x86: determine stack entropy based on mmap entropy

  Show description for 8b31fc5
  

  thestinger

  authored and

  anthraxx

  committed
  8b31fc5

  Copy full SHA for 8b31fc5

• arm64: determine stack entropy based on mmap entropy

  Show description for 01ece9e
  

  thestinger

  authored and

  anthraxx

  committed
  01ece9e

  Copy full SHA for 01ece9e

• randomize lower bits of the argument block

  Show description for b596f54
  

  thestinger

  authored and

  anthraxx

  committed
  b596f54

  Copy full SHA for b596f54

• x86_64: match arm64 brk randomization entropy

  Show description for 0f012fe
  

  thestinger

  authored and

  anthraxx

  committed
  0f012fe

  Copy full SHA for 0f012fe

• support randomizing the lower bits of brk

  Show description for 4f3d196
  

  thestinger

  authored and

  anthraxx

  committed
  4f3d196

  Copy full SHA for 4f3d196

• mm: randomize lower bits of brk

  Show description for 0e35de5
  

  thestinger

  authored and

  anthraxx

  committed
  0e35de5

  Copy full SHA for 0e35de5

• x86: randomize lower bits of brk

  Show description for e0da9d8
  

  thestinger

  authored and

  anthraxx

  committed
  e0da9d8

  Copy full SHA for e0da9d8

• mm: guarantee brk gap is at least one page

  Show description for b55113f
  

  thestinger

  authored and

  anthraxx

  committed
  b55113f

  Copy full SHA for b55113f

• x86: guarantee brk gap is at least one page

  Show description for 3a4c898
  

  thestinger

  authored and

  anthraxx

  committed
  3a4c898

  Copy full SHA for 3a4c898

• x86_64: bound mmap between legacy/modern bases

  

  thestinger

  authored and

  anthraxx

  committed
  293f984

  Copy full SHA for 293f984

• restrict device timing side channels

  Show description for 030e84d
  

  thestinger

  authored and

  anthraxx

  committed
  030e84d

  Copy full SHA for 030e84d

• add toggle for disabling newly added USB devices

  Show description for b36b517
  

  thestinger

  authored and

  anthraxx

  committed
  b36b517

  Copy full SHA for b36b517

• hard-wire legacy checkreqprot option to 0

  Show description for cc19037
  

  thestinger

  authored and

  anthraxx

  committed
  cc19037

  Copy full SHA for cc19037

• security: tty: Add owner user namespace to tty_struct

  Show description for 941ac11
  

  nmatt0

  authored and

  anthraxx

  committed
  941ac11

  Copy full SHA for 941ac11

• security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

  Show description for 3134273
  

  nmatt0

  authored and

  anthraxx

  committed
  3134273

  Copy full SHA for 3134273

• enable SECURITY_TIOCSTI_RESTRICT by default

  Show description for b3029bd
  

  thestinger

  authored and

  anthraxx

  committed
  b3029bd

  Copy full SHA for b3029bd

• disable unprivileged eBPF access by default

  anthraxx

  committed
  69b5671

  Copy full SHA for 69b5671

• enable BPF JIT hardening by default (if available)

  anthraxx

  committed
  453f635

  Copy full SHA for 453f635

• enable protected_{fifos,regular} by default

  anthraxx

  committed
  95d0499

  Copy full SHA for 95d0499

• Revert "mark kernel_set_to_readonly as __ro_after_init"

  Show description for 51bb625
  anthraxx

  committed
  51bb625

  Copy full SHA for 51bb625

• modpost: Add CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE

  Show description for 1336a9e
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  1336a9e

  Copy full SHA for 1336a9e

• mm: Fix extra_latent_entropy

  Show description for d803650
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  d803650

  Copy full SHA for d803650

• add CONFIG for unprivileged_userns_clone

  Show description for 86bcf07
  anthraxx

  committed
  86bcf07

  Copy full SHA for 86bcf07

• enable INIT_ON_ALLOC_DEFAULT_ON by default

  anthraxx

  committed
  b9b5b84

  Copy full SHA for b9b5b84

• enable INIT_ON_FREE_DEFAULT_ON by default

  anthraxx

  committed
  a746e05

  Copy full SHA for a746e05

• add CONFIG for unprivileged_userfaultfd

  Show description for 922fadc
  anthraxx

  committed
  922fadc

  Copy full SHA for 922fadc

• slub: Extend init_on_alloc to slab caches with constructors

  Show description for 932258a
  

  tsautereau-anssi

  authored and

  anthraxx

  committed
  932258a

  Copy full SHA for 932258a

Commits on Feb 9, 2020

• Disable TCP simultaneous connect

  Show description for 7ee82e5
  madaidan

  committed
  7ee82e5

  Copy full SHA for 7ee82e5

• Remove unneeded check

  madaidan

  authored
  c129b3e

  Copy full SHA for c129b3e

Commits on Feb 12, 2020

• Update ip-sysctl.txt

  madaidan

  authored
  20d301d

  Copy full SHA for 20d301d

• Update Kconfig

  madaidan

  authored
  119d0e4

  Copy full SHA for 119d0e4

• Set sysctl_tcp_simult_connect with kconfig

  madaidan

  authored
  ed345be

  Copy full SHA for ed345be

Commits on Feb 15, 2020

• Enable TCP simultaneous connect by default

  madaidan

  authored
  758aa6d

  Copy full SHA for 758aa6d