linux: Enforce userspace page table checks

  This feature is already supported by and enabled on all
architectures we support, this patch ensures IPFire will
always make use of it to rule out memory page tampering by
userspace applications.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 config/kernel/kernel.config.aarch64-ipfire | 2 +-
 config/kernel/kernel.config.riscv64-ipfire | 2 +-
 config/kernel/kernel.config.x86_64-ipfire  | 2 +-
 config/rootfiles/common/aarch64/linux      | 1 +
 config/rootfiles/common/riscv64/linux      | 1 +
 config/rootfiles/common/x86_64/linux       | 1 +
 6 files changed, 6 insertions(+), 3 deletions(-)
  

Hello,

This is a configuration option only available from kernel 6.10 onwards.

*Please build* those changes that you are submitting and *test* them first. We don’t want to avoid any regressions for the sake of hardening tiny things. We need to collect evidence ourselves how these things perform for our use case.

-Michael

> On 21 Sep 2024, at 20:48, Peter Müller <peter.mueller@ipfire.org> wrote:
> 
> This feature is already supported by and enabled on all
> architectures we support, this patch ensures IPFire will
> always make use of it to rule out memory page tampering by
> userspace applications.
> 
> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
> ---
> config/kernel/kernel.config.aarch64-ipfire | 2 +-
> config/kernel/kernel.config.riscv64-ipfire | 2 +-
> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
> config/rootfiles/common/aarch64/linux      | 1 +
> config/rootfiles/common/riscv64/linux      | 1 +
> config/rootfiles/common/x86_64/linux       | 1 +
> 6 files changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
> index 74085de00..b7f64d10c 100644
> --- a/config/kernel/kernel.config.aarch64-ipfire
> +++ b/config/kernel/kernel.config.aarch64-ipfire
> @@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=y
> # CONFIG_SLUB_DEBUG is not set
> # CONFIG_PAGE_OWNER is not set
> CONFIG_PAGE_TABLE_CHECK=y
> -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> # CONFIG_PAGE_POISONING is not set
> # CONFIG_DEBUG_PAGE_REF is not set
> # CONFIG_DEBUG_RODATA_TEST is not set
> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
> index 451607c17..e186bb9a8 100644
> --- a/config/kernel/kernel.config.riscv64-ipfire
> +++ b/config/kernel/kernel.config.riscv64-ipfire
> @@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=y
> # CONFIG_SLUB_DEBUG is not set
> # CONFIG_PAGE_OWNER is not set
> CONFIG_PAGE_TABLE_CHECK=y
> -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> CONFIG_PAGE_POISONING=y
> # CONFIG_DEBUG_PAGE_REF is not set
> # CONFIG_DEBUG_RODATA_TEST is not set
> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
> index 6f0f1bfa5..de6f76ce7 100644
> --- a/config/kernel/kernel.config.x86_64-ipfire
> +++ b/config/kernel/kernel.config.x86_64-ipfire
> @@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=y
> # CONFIG_SLUB_DEBUG is not set
> # CONFIG_PAGE_OWNER is not set
> CONFIG_PAGE_TABLE_CHECK=y
> -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> CONFIG_PAGE_POISONING=y
> # CONFIG_DEBUG_PAGE_REF is not set
> # CONFIG_DEBUG_RODATA_TEST is not set
> diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux
> index 53dedd2f3..3c9760570 100644
> --- a/config/rootfiles/common/aarch64/linux
> +++ b/config/rootfiles/common/aarch64/linux
> @@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
> #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
> +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
> #lib/modules/KVER/build/include/config/PAHOLE_VERSION
> #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE
> #lib/modules/KVER/build/include/config/PANIC_TIMEOUT
> diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux
> index dca2c7370..578e0d9fb 100644
> --- a/config/rootfiles/common/riscv64/linux
> +++ b/config/rootfiles/common/riscv64/linux
> @@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
> #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
> +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
> #lib/modules/KVER/build/include/config/PAHOLE_VERSION
> #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE
> #lib/modules/KVER/build/include/config/PANIC_TIMEOUT
> diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
> index cecaf36fa..2469ad645 100644
> --- a/config/rootfiles/common/x86_64/linux
> +++ b/config/rootfiles/common/x86_64/linux
> @@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
> #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
> +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
> #lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION
> #lib/modules/KVER/build/include/config/PAHOLE_VERSION
> #lib/modules/KVER/build/include/config/PANASONIC_LAPTOP
> -- 
> 2.39.5
>