[PATCH] linux: Disable cachestat() system call

[PATCH] linux: Disable cachestat() system call

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 4306 bytes --]

>From the kernel's documentation:

> Enable the cachestat system call, which queries the page
> cache statistics of a file (number of cached pages, dirty
> pages, pages marked for writeback, (recently) evicted pages).

There is no legitimate use-case for this feature in IPFire, and
grsecurity recommends disabling it to cut attack surface.

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 config/kernel/kernel.config.aarch64-ipfire | 2 +-
 config/kernel/kernel.config.riscv64-ipfire | 2 +-
 config/kernel/kernel.config.x86_64-ipfire  | 2 +-
 config/rootfiles/common/aarch64/linux      | 1 -
 config/rootfiles/common/riscv64/linux      | 1 -
 config/rootfiles/common/x86_64/linux       | 1 -
 6 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index 74085de00..b2753cdbf 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -243,7 +243,7 @@ CONFIG_KALLSYMS_BASE_RELATIVE=y
 CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
 CONFIG_KCMP=y
 CONFIG_RSEQ=y
-CONFIG_CACHESTAT_SYSCALL=y
+# CONFIG_CACHESTAT_SYSCALL is not set
 # CONFIG_DEBUG_RSEQ is not set
 CONFIG_HAVE_PERF_EVENTS=y
 CONFIG_GUEST_PERF_EVENTS=y
diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
index 451607c17..77487de34 100644
--- a/config/kernel/kernel.config.riscv64-ipfire
+++ b/config/kernel/kernel.config.riscv64-ipfire
@@ -245,7 +245,7 @@ CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_BASE_RELATIVE=y
 CONFIG_KCMP=y
 CONFIG_RSEQ=y
-CONFIG_CACHESTAT_SYSCALL=y
+# CONFIG_CACHESTAT_SYSCALL is not set
 # CONFIG_DEBUG_RSEQ is not set
 CONFIG_HAVE_PERF_EVENTS=y
 # CONFIG_PC104 is not set
diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index 6f0f1bfa5..c17757421 100644
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -264,7 +264,7 @@ CONFIG_KALLSYMS_BASE_RELATIVE=y
 CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
 CONFIG_KCMP=y
 CONFIG_RSEQ=y
-CONFIG_CACHESTAT_SYSCALL=y
+# CONFIG_CACHESTAT_SYSCALL is not set
 # CONFIG_DEBUG_RSEQ is not set
 CONFIG_HAVE_PERF_EVENTS=y
 CONFIG_GUEST_PERF_EVENTS=y
diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux
index 53dedd2f3..98eee80a7 100644
--- a/config/rootfiles/common/aarch64/linux
+++ b/config/rootfiles/common/aarch64/linux
@@ -7608,7 +7608,6 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER/build/include/config/BUILD_SALT
 #lib/modules/KVER/build/include/config/BUILTIN_RETURN_ADDRESS_STRIPS_PAC
 #lib/modules/KVER/build/include/config/CACHEFILES
-#lib/modules/KVER/build/include/config/CACHESTAT_SYSCALL
 #lib/modules/KVER/build/include/config/CARL9170
 #lib/modules/KVER/build/include/config/CARL9170_HWRNG
 #lib/modules/KVER/build/include/config/CARL9170_LEDS
diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux
index dca2c7370..626238714 100644
--- a/config/rootfiles/common/riscv64/linux
+++ b/config/rootfiles/common/riscv64/linux
@@ -6940,7 +6940,6 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER/build/include/config/BUILDTIME_TABLE_SORT
 #lib/modules/KVER/build/include/config/BUILD_SALT
 #lib/modules/KVER/build/include/config/CACHEFILES
-#lib/modules/KVER/build/include/config/CACHESTAT_SYSCALL
 #lib/modules/KVER/build/include/config/CADENCE_WATCHDOG
 #lib/modules/KVER/build/include/config/CARDBUS
 #lib/modules/KVER/build/include/config/CARL9170
diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
index cecaf36fa..6505e9a54 100644
--- a/config/rootfiles/common/x86_64/linux
+++ b/config/rootfiles/common/x86_64/linux
@@ -7289,7 +7289,6 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER/build/include/config/BUILDTIME_TABLE_SORT
 #lib/modules/KVER/build/include/config/BUILD_SALT
 #lib/modules/KVER/build/include/config/CACHEFILES
-#lib/modules/KVER/build/include/config/CACHESTAT_SYSCALL
 #lib/modules/KVER/build/include/config/CADENCE_WATCHDOG
 #lib/modules/KVER/build/include/config/CALL_DEPTH_TRACKING
 #lib/modules/KVER/build/include/config/CALL_PADDING
-- 
2.39.5