About FreeRTOS security requirement

Kernel
1

Hello,
I want to know the FreeRTOS kernal (or OPEN RTOS/SAFERTOS) whether it meet the following safety requirements.
As a security requirement, it is necessary to implement various buffer overflow countermeasures.

  1. Enable SSP (Stack Smashing Protector).
  2. Enable DEP (Data Execution Prevention).
  3. Enable Automatic Fortification.
  4. Enable ASLR (address space layout randomization).
  5. Enable RELRO (RELocation Read-Only).
2

I don’t know if it can support all those features, but it can only support them on a processor that has them, so this is VERY much a port-specific question.

It does support SSP on at least some processors that support that.

ASLR would require a custom bootloader to read the code out of a boot store and load it at a random address. This would be an unusual requrest for the sort of system that FreeRTOS runs, it is much more of the sort of thing done is systems with an OS that runs an assortment of programs, rather than a system that has a single program with an internal RTOS to schedule the various tasks within it.

This very much seems to be trying to apply a SECURITY model (not a SAFETY model) that isn’t actually appropriate for the system. (Randomization doesn’t help Safety, only Security).

3

Thanks for your reply

I understand that what you are saying is correct.
For the following security requirements, I understand that they may depend on hardware or compilers.
Currently, the core we are using is arm Cortex-M4f, which is equipped with freertos.
What are the security requirements that may be applicable? Please confirm.

BR

4

What security requirements are needed, will be a function of the project and its requirements.

What security features are available are a function of the processor.

As I remember, the M4F doesn’t have a hardware “Stack Smashing Protection” capability, but FreeRTOS can implement a version in software, but that only tries to detect the smash after it occurs, so not a reliable.

DEP would only be availabie if you use the MPU, and it may have limited effectiveness, I am not sure if FreeRTOS itself would be under that limitation.

The others will be very much system dependent.

5

I suggest you look at the Arm Cortex M33F processors. These are generally similar to M4F but one of the enhancement options is a stack limit register. Just like the M4F, if you get one with the MMU option then you can also implement DEP.