diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2016-10-15 10:03:15 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2016-10-15 10:03:15 -0700 |
commit | 9ffc66941df278c9f4df979b6bcf6c6ddafedd16 (patch) | |
tree | a2cff20aafb7ecb352a0c2dd41a5430f64a248e0 /arch/Kconfig | |
parent | 133d970e0dadf7b413db19893acc5b26664bf4a1 (diff) | |
parent | 0766f788eb727e2e330d55d30545db65bcf2623f (diff) | |
download | linux-stable-9ffc66941df278c9f4df979b6bcf6c6ddafedd16.tar.gz linux-stable-9ffc66941df278c9f4df979b6bcf6c6ddafedd16.tar.bz2 linux-stable-9ffc66941df278c9f4df979b6bcf6c6ddafedd16.zip |
Merge tag 'gcc-plugins-v4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull gcc plugins update from Kees Cook:
"This adds a new gcc plugin named "latent_entropy". It is designed to
extract as much possible uncertainty from a running system at boot
time as possible, hoping to capitalize on any possible variation in
CPU operation (due to runtime data differences, hardware differences,
SMP ordering, thermal timing variation, cache behavior, etc).
At the very least, this plugin is a much more comprehensive example
for how to manipulate kernel code using the gcc plugin internals"
* tag 'gcc-plugins-v4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
latent_entropy: Mark functions with __latent_entropy
gcc-plugins: Add latent_entropy plugin
Diffstat (limited to 'arch/Kconfig')
-rw-r--r-- | arch/Kconfig | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/arch/Kconfig b/arch/Kconfig index 11d349561ece..659bdd079277 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -383,6 +383,24 @@ config GCC_PLUGIN_SANCOV gcc-4.5 on). It is based on the commit "Add fuzzing coverage support" by Dmitry Vyukov <dvyukov@google.com>. +config GCC_PLUGIN_LATENT_ENTROPY + bool "Generate some entropy during boot and runtime" + depends on GCC_PLUGINS + help + By saying Y here the kernel will instrument some kernel code to + extract some entropy from both original and artificially created + program state. This will help especially embedded systems where + there is little 'natural' source of entropy normally. The cost + is some slowdown of the boot process (about 0.5%) and fork and + irq processing. + + Note that entropy extracted this way is not cryptographically + secure! + + This plugin was ported from grsecurity/PaX. More information at: + * https://grsecurity.net/ + * https://pax.grsecurity.net/ + config HAVE_CC_STACKPROTECTOR bool help |