diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg new file mode 100644 index 0000000..be234e5 --- /dev/null +++ b/etc/default/grub.d/40_kernel_hardening.cfg @@ -0,0 +1,11 @@ +# Disables the merging of slabs of similar sizes. Sometimes a slab can be used in a vulnerable way which an attacker can exploit. +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" + +# Enables sanity checks (F), redzoning (Z) and poisoning (P). +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZP" + +# Wipes free memory so it can't leak in various ways and prevents some use-after-free vulnerabilites. +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1" + +# Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" diff --git a/etc/sysctl.d/harden_bpf.conf b/etc/sysctl.d/harden_bpf.conf new file mode 100644 index 0000000..a039bfd --- /dev/null +++ b/etc/sysctl.d/harden_bpf.conf @@ -0,0 +1,3 @@ +# Hardens the BPF JIT compiler and restricts it to root. +kernel.unprivileged_bpf_disabled=1 +net.core.bpf_jit_harden=2 diff --git a/etc/sysctl.d/kptr_restrict.conf b/etc/sysctl.d/kptr_restrict.conf new file mode 100644 index 0000000..a6f46cd --- /dev/null +++ b/etc/sysctl.d/kptr_restrict.conf @@ -0,0 +1,2 @@ +# Hides kernel symbols in /proc/kallsyms +kernel.kptr_restrict=2 diff --git a/etc/sysctl.d/mmap_aslr.conf b/etc/sysctl.d/mmap_aslr.conf new file mode 100644 index 0000000..4bcdbeb --- /dev/null +++ b/etc/sysctl.d/mmap_aslr.conf @@ -0,0 +1,3 @@ +# Improves KASLR effectiveness for mmap. +vm.mmap_rnd_bits=32 +vm.mmap_rnd_compat_bits=16