mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-24 21:57:55 +07:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'github-kicksecure/master'

Browse Source
This commit is contained in:
Patrick Schleizer 2022-08-22 06:09:30 -04:00
commit cdfc175953
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -68,9 +68,6 @@ use-after-free vulnerabilities and erase sensitive information in memory.
* Page allocator freelist randomization is enabled.
* The machine check tolerance level is decreased which makes the kernel panic
on uncorrectable errors in ECC memory that could be exploited.
* Kernel Page Table Isolation is enabled to mitigate Meltdown and increase
KASLR effectiveness.

5
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -17,8 +17,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## Zero memory at allocation and free time.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
## Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
## Machine check exception handler decides whether the system should panic or not based on the exception that happened.
## https://forums.whonix.org/t/kernel-hardening/7296/494
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"