mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-07 14:01:06 +07:00
Code Issues Packages Projects Releases Wiki Activity

unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...)

Browse Source 
this might reduce performance

* `spectre_v2=on`
* `spec_store_bypass_disable=on`
* `tsx=off`
* `tsx_async_abort=full,nosmt`

Thanks to @madaidan for the suggestion!

https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
This commit is contained in:
Patrick Schleizer 2020-01-30 05:55:13 -05:00
parent 2711d0f7f0
commit b9d65338bc
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -36,6 +36,14 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt"
## Enables all mitigations for the MDS vulnerability.
## Disables smt which can be used to exploit the MDS vulnerability.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"