[PATCH 1/2] hardening: make stack guard page the default

[PATCH 1/2] hardening: make stack guard page the default

[Ahmad Fatoum]

We have had guard page support for close to two years now and it's time
we start enabling it by default to catch stack overflows.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 lib/Kconfig.hardening | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/Kconfig.hardening b/lib/Kconfig.hardening
index 658de4953aa1..53bf4d5bb956 100644
--- a/lib/Kconfig.hardening
+++ b/lib/Kconfig.hardening
@@ -153,6 +153,7 @@ config FORTIFY_SOURCE
 config STACK_GUARD_PAGE
 	bool "Place guard page to catch stack overflows"
 	depends on ARM && MMU
+	default y
 	help
 	  When enabled, barebox places a faulting guard page to catch total
 	  stack usage exceeding CONFIG_STACK_SIZE. On overflows, that hit
-- 
2.39.5

[PATCH 2/2] hardening: update text after addition of CONFIG_ARM_MMU_PERMISSIONS

[Ahmad Fatoum]

Until we have wired CONFIG_MEMORY_ATTRIBUTES with CONFIG_ARM_MMU_PERMISSIONS,
add a notice to the help text about it.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 lib/Kconfig.hardening | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/Kconfig.hardening b/lib/Kconfig.hardening
index 53bf4d5bb956..d9f6909eca51 100644
--- a/lib/Kconfig.hardening
+++ b/lib/Kconfig.hardening
@@ -261,8 +261,9 @@ config MEMORY_ATTRIBUTES
 	bool "record memory attributes" if EXPERIMENTAL
 	help
 	  Tag all SDRAM memory region requests with type and attributes.
-	  This is currently not acted upon, but protections (e.g. read-only)
-	  will in future be enforced by the MMU.
+	  This is currently independent from ARM_MMU_PERMISSIONS, but protections
+	  (e.g. read-only) may in future be enforced by the MMU in addition
+	  to the protections already in-place.
 
 endmenu
 
-- 
2.39.5