V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m16s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m16s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -128,56 +128,56 @@ dropbear:
|
||||
# https://docs.kernel.org/admin-guide/kernel-parameters.html
|
||||
################################################################################################################################
|
||||
grub_parameter:
|
||||
##############################################################################################################################
|
||||
# [ USB ] Default USB device authorization:
|
||||
# default -1 = authorized (same as 1)
|
||||
# 0 = not authorized, 1 = authorized, 2 = authorized if a device connected to an internal port.
|
||||
##############################################################################################################################
|
||||
- "usbcore.authorized_default=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go
|
||||
# undetected. During boot if audit=1, then the backlog will hold 64 records. If more than 64 records are created during boot,
|
||||
# auditd records will be lost, and potential malicious activity could go undetected.
|
||||
##############################################################################################################################
|
||||
- "audit=1"
|
||||
- "audit_backlog_limit=8192"
|
||||
- "audit=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Distrusts CPU bootloader for initial entropy at boot. Distrusts the CPU for initial entropy at boot, as it is not possible
|
||||
# to audit, may contain weaknesses or a backdoor.
|
||||
# https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||
# https://twitter.com/pid_eins/status/1149649806056280069
|
||||
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
# CFI Ensures that only controlled, predefined transitions are possible in the programs' control flow.
|
||||
# kcfi (Kernel Control Flow Integrity): Specific implementation of CFI for the Linux kernel that is particularly robust and
|
||||
# provides accurate control flow validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special
|
||||
# checks and instrumentation into the kernel code.
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
##############################################################################################################################
|
||||
- "random.trust_cpu=off"
|
||||
- "cfi=kcfi"
|
||||
|
||||
##############################################################################################################################
|
||||
# Distrusts the bootloader for initial entropy at boot.
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
# Prevents the debugfsfile system from being made available at boot time. This is a useful hardening measure because debugfs
|
||||
# reveals a lot of potentially security-relevant kernel information by default, which can be misused by normal users and by
|
||||
# exploits.
|
||||
##############################################################################################################################
|
||||
- "random.trust_bootloader=off"
|
||||
- "debugfs=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# ASLR (Address Space Layout Randomization) causes central areas of memory to be assigned random addresses each time a program
|
||||
# is started. These include: Stack, Heap, Shared libraries (e.g., libc), mmap regions, VDSO/VSyscall. The executable itself
|
||||
# (only with PIE binaries). The aim is to make it more difficult for attackers to predict memory addresses, thereby preventing
|
||||
# classic exploits that rely on known addresses from succeeding.
|
||||
# 0: disabled Fixed memory addresses – insecure, testable.
|
||||
# 1: Partial ASLR Heap, mmap are randomized, stack only partially randomized.
|
||||
# 2: Full ASLR (default) Stack, mmap, heap, VDSO, shared libraries all randomized.
|
||||
# Disable the busmaster bit on all PCI bridges during very early boot to avoid holes in IOMMU.
|
||||
# https://mjg59.dreamwidth.org/54433.html
|
||||
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||
##############################################################################################################################
|
||||
- "randomize_va_space=2"
|
||||
- "efi=disable_early_pci_dma"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables IOMMU to prevent DMA attacks. intel_iommu=on amd_iommu=force_isolation iommu=force
|
||||
# Multiple IOMMU switches are redundant; iommu=force is usually sufficient. Forces an IOMMU to be initialized and used
|
||||
# completely, even if the BIOS or ACPI wanted to disable it. It activates the basic DMA remapping function. However, it does
|
||||
# not say anything about how restrictive the mapping strategy is, 'passthrough', 'strict', see below.
|
||||
# Checks every copy_to_user() / copy_from_user()operation. Prevents kernels from accidentally copying unallocated memory to
|
||||
# userspace. Stop exploits that trigger buffer overflows or use-after-free via copy_*_user(), for example. Effect: Detects
|
||||
# heap/SLOB abuse, overwrites. Leads to BUG() & stack trace if suspicious access is detected.
|
||||
##############################################################################################################################
|
||||
- "iommu=force"
|
||||
- "hardened_usercopy=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Remove additional (32-bit) attack surface, unless you really need them.
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
##############################################################################################################################
|
||||
- "ia32_emulation=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# Zero memory at allocation and free time.
|
||||
##############################################################################################################################
|
||||
- "init_on_alloc=1"
|
||||
- "init_on_free=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables strict enforcement of IOMMU TLB invalidation, so devices will never be able to access stale data contents.
|
||||
@@ -196,122 +196,23 @@ grub_parameter:
|
||||
- "iommu.strict=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Disable the busmaster bit on all PCI bridges during very early boot to avoid holes in IOMMU.
|
||||
# https://mjg59.dreamwidth.org/54433.html
|
||||
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||
# Enables IOMMU to prevent DMA attacks. intel_iommu=on amd_iommu=force_isolation iommu=force
|
||||
# Multiple IOMMU switches are redundant; iommu=force is usually sufficient. Forces an IOMMU to be initialized and used
|
||||
# completely, even if the BIOS or ACPI wanted to disable it. It activates the basic DMA remapping function. However, it does
|
||||
# not say anything about how restrictive the mapping strategy is, 'passthrough', 'strict', see below.
|
||||
##############################################################################################################################
|
||||
- "efi=disable_early_pci_dma"
|
||||
- "iommu=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Disables the merging of slabs of similar sizes. Sometimes a slab can be used vulnerably, which an attacker can exploit.
|
||||
# Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety error detector. KFENCE detects a heap of
|
||||
# out-of-bounds access, use-after-free, and invalid-free errors. KFENCE is designed to be enabled in production kernels and
|
||||
# has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind
|
||||
# KFENCE design is that with enough total uptime, KFENCE will detect bugs in code paths not typically exercised by
|
||||
# non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a
|
||||
# large fleet of machines.
|
||||
# https://docs.kernel.org/dev-tools/kfence.html
|
||||
##############################################################################################################################
|
||||
- "slab_nomerge"
|
||||
|
||||
##############################################################################################################################
|
||||
# Zero memory at allocation and free time.
|
||||
##############################################################################################################################
|
||||
- "init_on_alloc=1"
|
||||
- "init_on_free=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# This option randomizes page allocator freelists, improving security by making page allocations less predictable. This also
|
||||
# improves performance.
|
||||
##############################################################################################################################
|
||||
- "page_alloc.shuffle=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# When releasing (i.e., free_pages()), all bytes with a marker value (e.g., 0xAA) are overwritten. If later code
|
||||
# (accidentally or maliciously) accesses this page, it will most likely crash or produce recognizable artifacts. Only
|
||||
# supported if the kernel was built with CONFIG_PAGE_POISONING=y (default on Debian: enabled since Bookworm).
|
||||
##############################################################################################################################
|
||||
- "page_poison=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR.
|
||||
##############################################################################################################################
|
||||
- "pti=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# The setting 'vsyscall' is obsolete, are at fixed addresses and are a target for ROP.
|
||||
##############################################################################################################################
|
||||
- "vsyscall=none"
|
||||
|
||||
##############################################################################################################################
|
||||
# The kernel adds a small random padding offset to the stack pointer with every system call or kernel entry. The starting
|
||||
# point for local variables is at a different position within the stack with every call. This makes ROP chains
|
||||
# (return-oriented programming) or stack pivoting attacks significantly more difficult.
|
||||
##############################################################################################################################
|
||||
- "randomize_kstack_offset=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Prevents the debugfsfile system from being made available at boot time. This is a useful hardening measure because debugfs
|
||||
# reveals a lot of potentially security-relevant kernel information by default, which can be misused by normal users and by
|
||||
# exploits.
|
||||
##############################################################################################################################
|
||||
- "debugfs=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# Force the kernel to panic on "oopses" (which may be due to false positives).
|
||||
# - 'panic=N' (e.g., 'panic=60'): Wait N seconds and then reboot.
|
||||
# - 'panic=0' No automatic action (System remains stuck in panic state).
|
||||
# - 'panic=-1' Also explicitly prevents any automatic reboot.
|
||||
##############################################################################################################################
|
||||
#- "oops=panic"
|
||||
#- "panic=-1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enable a subset of known mitigations for CPU vulnerabilities and disable SMT.
|
||||
# - 'mitigations=auto' Enables all available CPU-specific security measures based on the detected CPU, microcode version, and
|
||||
# kernel build configuration, if applicable.
|
||||
# - 'nosmt' Disables Simultaneous Multithreading (SMT) (e.g., Hyper-Threading on Intel) system-wide to prevent shared cache
|
||||
# attacks (SMoTHER, MDS, L1TF, TAA, Snoop-assisted).
|
||||
# Why is 'mitigations=auto,nosmt' better than setting everything manually?
|
||||
# Automatically adjusted: Depending on CPU family, stepping, microcode.
|
||||
# Consistency guaranteed: No contradictions between flags are possible
|
||||
# (e.g., spec_store_bypass_disable=on vs. nospec_store_bypass_disable=off).
|
||||
# Future-proof: Even new features (e.g., bhi=flush or srbds) are automatically activated without having to know about them.
|
||||
##############################################################################################################################
|
||||
- "mitigations=auto,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for both 'Spectre Variant 2' (indirect branch speculation) and Intel branch history injection (BHI)
|
||||
# vulnerabilities.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
||||
##############################################################################################################################
|
||||
#- "spectre_v2=on"
|
||||
#- "spectre_v2_user=on"
|
||||
#- "spectre_bhi=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Disable Speculative Store Bypass (Spectre Variant 4).
|
||||
# https://www.suse.com/support/kb/doc/?id=000019189
|
||||
##############################################################################################################################
|
||||
#- "spec_store_bypass_disable=on"
|
||||
#- "nospec_store_bypass_disable=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for the L1TF vulnerability through disabling SMT and L1D flush runtime control.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
||||
##############################################################################################################################
|
||||
#- "l1tf=full,force"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for the MDS vulnerability through clearing the buffer cache and disabling SMT.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
||||
##############################################################################################################################
|
||||
#- "mds=full,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Patches the TAA vulnerability by disabling TSX and enables mitigations using TSX Async Abort along with disabling SMT.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
||||
##############################################################################################################################
|
||||
#- "tsx=off"
|
||||
#- "tsx_async_abort=full,nosmt"
|
||||
- "kfence.sample_interval=100"
|
||||
|
||||
##############################################################################################################################
|
||||
# Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit.
|
||||
@@ -319,12 +220,6 @@ grub_parameter:
|
||||
##############################################################################################################################
|
||||
- "kvm.nx_huge_pages=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Force disable SMT as it has caused numerous CPU vulnerabilities. The only full mitigation of cross-HT attacks is disabling.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||||
##############################################################################################################################
|
||||
- "nosmt=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables the prctl interface to prevent leaks from L1D on context switches.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
|
||||
@@ -332,25 +227,11 @@ grub_parameter:
|
||||
- "l1d_flush=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
|
||||
# mmio_stale_data=off No mitigation (unsafe)
|
||||
# mmio_stale_data=full All known measures active
|
||||
# mmio_stale_data=full,nosmt Full mitigation + SMT disabling
|
||||
# mmio_stale_data=auto Activated depending on CPU/microcode
|
||||
# mmio_stale_data=full,force Forces mitigation even on CPUs that are supposedly not affected.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for the L1TF vulnerability through disabling SMT and L1D flush runtime control.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
||||
##############################################################################################################################
|
||||
- "mmio_stale_data=full,force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with Return Instructions) vulnerability and disable
|
||||
# SMT. If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant mitigations, provided the CPU
|
||||
# is affected; 'retbleed=auto,nosmt' explicitly overrides the internal assessment and forces full protection. If maximum
|
||||
# hardening is required, and one does not want to rely on "auto-detection", then it is recommended to additionally set
|
||||
# 'retbleed=auto,nosmt' otherwise, 'mitigations=auto,nosmt' is sufficient.
|
||||
# https://www.suse.com/support/kb/doc/?id=000020693
|
||||
##############################################################################################################################
|
||||
- "retbleed=auto,nosmt"
|
||||
#- "l1tf=full,force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables kernel lockdown mode with a focus on confidentiality. The kernel is configured in such a way that even privileged
|
||||
@@ -375,6 +256,130 @@ grub_parameter:
|
||||
##############################################################################################################################
|
||||
- "lockdown=integrity"
|
||||
|
||||
##############################################################################################################################
|
||||
# All Kernel Messages with a loglevel smaller than the console loglevel will be printed to the console. It can also be
|
||||
# changed with 'klogd' or other programs. The log levels are defined as follows:
|
||||
# 0 (KERN_EMERG) system is unusable
|
||||
# 1 (KERN_ALERT) action must be taken immediately
|
||||
# 2 (KERN_CRIT) critical conditions
|
||||
# 3 (KERN_ERR) error conditions
|
||||
# 4 (KERN_WARNING) warning conditions
|
||||
# 5 (KERN_NOTICE) normal but significant condition
|
||||
# 6 (KERN_INFO) informational
|
||||
# 7 (KERN_DEBUG) debug-level messages
|
||||
##############################################################################################################################
|
||||
- "loglevel=7"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for the MDS vulnerability through clearing the buffer cache and disabling SMT.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
||||
##############################################################################################################################
|
||||
#- "mds=full,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enable a subset of known mitigations for CPU vulnerabilities and disable SMT.
|
||||
# - 'mitigations=auto' Enables all available CPU-specific security measures based on the detected CPU, microcode version, and
|
||||
# kernel build configuration, if applicable.
|
||||
# - 'nosmt' Disables Simultaneous Multithreading (SMT) (e.g., Hyper-Threading on Intel) system-wide to prevent shared cache
|
||||
# attacks (SMoTHER, MDS, L1TF, TAA, Snoop-assisted).
|
||||
# Why is 'mitigations=auto,nosmt' better than setting everything manually?
|
||||
# Automatically adjusted: Depending on CPU family, stepping, microcode.
|
||||
# Consistency guaranteed: No contradictions between flags are possible
|
||||
# (e.g., spec_store_bypass_disable=on vs. nospec_store_bypass_disable=off).
|
||||
# Future-proof: Even new features (e.g., bhi=flush or srbds) are automatically activated without having to know about them.
|
||||
##############################################################################################################################
|
||||
- "mitigations=auto,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
|
||||
# mmio_stale_data=off No mitigation (unsafe)
|
||||
# mmio_stale_data=full All known measures active
|
||||
# mmio_stale_data=full,nosmt Full mitigation + SMT disabling
|
||||
# mmio_stale_data=auto Activated depending on CPU/microcode
|
||||
# mmio_stale_data=full,force Forces mitigation even on CPUs that are supposedly not affected.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||||
##############################################################################################################################
|
||||
- "mmio_stale_data=full,force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Force disable SMT as it has caused numerous CPU vulnerabilities. The only full mitigation of cross-HT attacks is disabling.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||||
##############################################################################################################################
|
||||
- "nosmt=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Force the kernel to panic on "oopses" (which may be due to false positives).
|
||||
# - 'panic=N' (e.g., 'panic=60'): Wait N seconds and then reboot.
|
||||
# - 'panic=0' No automatic action (System remains stuck in panic state).
|
||||
# - 'panic=-1' Also explicitly prevents any automatic reboot.
|
||||
##############################################################################################################################
|
||||
- "oops=panic"
|
||||
- "panic=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# This option randomizes page allocator freelists, improving security by making page allocations less predictable. This also
|
||||
# improves performance.
|
||||
##############################################################################################################################
|
||||
- "page_alloc.shuffle=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# When releasing (i.e., free_pages()), all bytes with a marker value (e.g., 0xAA) are overwritten. If later code
|
||||
# (accidentally or maliciously) accesses this page, it will most likely crash or produce recognizable artifacts. Only
|
||||
# supported if the kernel was built with CONFIG_PAGE_POISONING=y (default on Debian: enabled since Bookworm).
|
||||
##############################################################################################################################
|
||||
- "page_poison=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR.
|
||||
##############################################################################################################################
|
||||
- "pti=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Distrusts the bootloader for initial entropy at boot.
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
##############################################################################################################################
|
||||
- "random.trust_bootloader=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# Distrusts CPU bootloader for initial entropy at boot. Distrusts the CPU for initial entropy at boot, as it is not possible
|
||||
# to audit, may contain weaknesses or a backdoor.
|
||||
# https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||
# https://twitter.com/pid_eins/status/1149649806056280069
|
||||
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
##############################################################################################################################
|
||||
- "random.trust_cpu=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# The kernel adds a small random padding offset to the stack pointer with every system call or kernel entry. The starting
|
||||
# point for local variables is at a different position within the stack with every call. This makes ROP chains
|
||||
# (return-oriented programming) or stack pivoting attacks significantly more difficult.
|
||||
##############################################################################################################################
|
||||
- "randomize_kstack_offset=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# ASLR (Address Space Layout Randomization) causes central areas of memory to be assigned random addresses each time a program
|
||||
# is started. These include: Stack, Heap, Shared libraries (e.g., libc), mmap regions, VDSO/VSyscall. The executable itself
|
||||
# (only with PIE binaries). The aim is to make it more difficult for attackers to predict memory addresses, thereby preventing
|
||||
# classic exploits that rely on known addresses from succeeding.
|
||||
# 0: disabled Fixed memory addresses – insecure, testable.
|
||||
# 1: Partial ASLR Heap, mmap are randomized, stack only partially randomized.
|
||||
# 2: Full ASLR (default) Stack, mmap, heap, VDSO, shared libraries all randomized.
|
||||
##############################################################################################################################
|
||||
- "randomize_va_space=2"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with Return Instructions) vulnerability and disable
|
||||
# SMT. If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant mitigations, provided the CPU
|
||||
# is affected; 'retbleed=auto,nosmt' explicitly overrides the internal assessment and forces full protection. If maximum
|
||||
# hardening is required, and one does not want to rely on "auto-detection", then it is recommended to additionally set
|
||||
# 'retbleed=auto,nosmt' otherwise, 'mitigations=auto,nosmt' is sufficient.
|
||||
# https://www.suse.com/support/kb/doc/?id=000020693
|
||||
##############################################################################################################################
|
||||
- "retbleed=auto,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables 'Read-Only Data Protection', which implements read-only memory areas for kernel data structures. This protects the
|
||||
# kernel from certain types of exploit (e.g., buffer overflows). 'on': Forces the corresponding areas to remain read-only.
|
||||
@@ -383,31 +388,42 @@ grub_parameter:
|
||||
- "rodata=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety error detector. KFENCE detects a heap of
|
||||
# out-of-bounds access, use-after-free, and invalid-free errors. KFENCE is designed to be enabled in production kernels and
|
||||
# has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind
|
||||
# KFENCE design is that with enough total uptime, KFENCE will detect bugs in code paths not typically exercised by
|
||||
# non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a
|
||||
# large fleet of machines.
|
||||
# https://docs.kernel.org/dev-tools/kfence.html
|
||||
# Disables the merging of slabs of similar sizes. Sometimes a slab can be used vulnerably, which an attacker can exploit.
|
||||
##############################################################################################################################
|
||||
- "kfence.sample_interval=100"
|
||||
- "slab_nomerge"
|
||||
|
||||
##############################################################################################################################
|
||||
# CFI Ensures that only controlled, predefined transitions are possible in the programs' control flow.
|
||||
# kcfi (Kernel Control Flow Integrity): Specific implementation of CFI for the Linux kernel that is particularly robust and
|
||||
# provides accurate control flow validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special
|
||||
# checks and instrumentation into the kernel code.
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Disable Speculative Store Bypass (Spectre Variant 4).
|
||||
# https://www.suse.com/support/kb/doc/?id=000019189
|
||||
##############################################################################################################################
|
||||
- "cfi=kcfi"
|
||||
#- "spec_store_bypass_disable=on"
|
||||
#- "nospec_store_bypass_disable=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# Remove additional (32-bit) attack surface, unless you really need them.
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for both 'Spectre Variant 2' (indirect branch speculation) and Intel branch history injection (BHI)
|
||||
# vulnerabilities.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
||||
##############################################################################################################################
|
||||
- "ia32_emulation=0"
|
||||
#- "spectre_v2=on"
|
||||
#- "spectre_v2_user=on"
|
||||
#- "spectre_bhi=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Patches the TAA vulnerability by disabling TSX and enables mitigations using TSX Async Abort along with disabling SMT.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
||||
##############################################################################################################################
|
||||
#- "tsx=off"
|
||||
#- "tsx_async_abort=full,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# [ USB ] Default USB device authorization:
|
||||
# default -1 = authorized (same as 1)
|
||||
# 0 = not authorized, 1 = authorized, 2 = authorized if a device connected to an internal port.
|
||||
##############################################################################################################################
|
||||
- "usbcore.authorized_default=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# Removes mapping for 32-bit VDSO (for ia32binaries). On 32-bit processes that rely on VDSO, this causes a fallback to classic
|
||||
@@ -417,16 +433,9 @@ grub_parameter:
|
||||
- "vdso32=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# Checks every copy_to_user() / copy_from_user()operation. Prevents kernels from accidentally copying unallocated memory to
|
||||
# userspace. Stop exploits that trigger buffer overflows or use-after-free via copy_*_user(), for example. Effect: Detects
|
||||
# heap/SLOB abuse, overwrites. Leads to BUG() & stack trace if suspicious access is detected.
|
||||
# The setting 'vsyscall' is obsolete, are at fixed addresses and are a target for ROP.
|
||||
##############################################################################################################################
|
||||
- "hardened_usercopy=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Sets the minimum log output of the kernel at boot time to level 0 (= KERN_EMERG).
|
||||
##############################################################################################################################
|
||||
#- "loglevel=0"
|
||||
- "vsyscall=none"
|
||||
|
||||
################################################################################################################################
|
||||
# Grub settings
|
||||
|
||||
Reference in New Issue
Block a user