From 351db0ef7f0e0eee09496ba56ec13d07ae84761e Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Sun, 5 May 2019 14:34:41 +0000
Subject: [PATCH 1/5] Create kptr_restrict.conf

---
 etc/sysctl.d/kptr_restrict.conf | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 etc/sysctl.d/kptr_restrict.conf

diff --git a/etc/sysctl.d/kptr_restrict.conf b/etc/sysctl.d/kptr_restrict.conf
new file mode 100644
index 0000000..a6f46cd
--- /dev/null
+++ b/etc/sysctl.d/kptr_restrict.conf
@@ -0,0 +1,2 @@
+# Hides kernel symbols in /proc/kallsyms 
+kernel.kptr_restrict=2 

From 197c1120a9f9f9a38548e4341d12b404fe72fde9 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Sun, 5 May 2019 14:35:42 +0000
Subject: [PATCH 2/5] Create harden_bpf.conf

---
 etc/sysctl.d/harden_bpf.conf | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 etc/sysctl.d/harden_bpf.conf

diff --git a/etc/sysctl.d/harden_bpf.conf b/etc/sysctl.d/harden_bpf.conf
new file mode 100644
index 0000000..a039bfd
--- /dev/null
+++ b/etc/sysctl.d/harden_bpf.conf
@@ -0,0 +1,3 @@
+# Hardens the BPF JIT compiler and restricts it to root.
+kernel.unprivileged_bpf_disabled=1
+net.core.bpf_jit_harden=2

From d2ca85c6860322a35ef0eb347c01c9f21dcf144f Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Sun, 5 May 2019 14:36:30 +0000
Subject: [PATCH 3/5] Create mmap_aslr.conf

---
 etc/sysctl.d/mmap_aslr.conf | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 etc/sysctl.d/mmap_aslr.conf

diff --git a/etc/sysctl.d/mmap_aslr.conf b/etc/sysctl.d/mmap_aslr.conf
new file mode 100644
index 0000000..4bcdbeb
--- /dev/null
+++ b/etc/sysctl.d/mmap_aslr.conf
@@ -0,0 +1,3 @@
+# Improves KASLR effectiveness for mmap.
+vm.mmap_rnd_bits=32
+vm.mmap_rnd_compat_bits=16

From 3695d7491ef8a7af81c0c2aad0babc48ec30af81 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Sun, 5 May 2019 14:42:03 +0000
Subject: [PATCH 4/5] Create 40_kernel_hardening.cfg

---
 etc/default/grub.d/40_kernel_hardening.cfg | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 etc/default/grub.d/40_kernel_hardening.cfg

diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg
new file mode 100644
index 0000000..0a39fa9
--- /dev/null
+++ b/etc/default/grub.d/40_kernel_hardening.cfg
@@ -0,0 +1,2 @@
+# Disables the merging of slabs of similar sizes. Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"

From 02e8888b0bc4f0dfadccbebc9e6e75849d32ba76 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Sun, 5 May 2019 20:17:33 +0000
Subject: [PATCH 5/5] Update 40_kernel_hardening.cfg

---
 etc/default/grub.d/40_kernel_hardening.cfg | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg
index 0a39fa9..be234e5 100644
--- a/etc/default/grub.d/40_kernel_hardening.cfg
+++ b/etc/default/grub.d/40_kernel_hardening.cfg
@@ -1,2 +1,11 @@
 # Disables the merging of slabs of similar sizes. Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
+
+# Enables sanity checks (F), redzoning (Z) and poisoning (P). 
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZP"
+
+# Wipes free memory so it can't leak in various ways and prevents some use-after-free vulnerabilites. 
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1"
+
+# Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. 
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"