mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-07-14 01:42:01 +07:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Patrick Schleizer
2019-12-24 05:57:24 -05:00
parent 9d77d88a4d 27a42a9da8
commit d03a3d9ac0
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -1,25 +1,25 @@
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net> ## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
kver="$(uname -r)" kver="$(dpkg-query --show --showformat='${Version}' linux-image-amd64)"
#echo "## kver: $kver" #echo "## kver: $kver"
## Disables the merging of slabs of similar sizes. ## Disables the merging of slabs of similar sizes.
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit. ## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## Enables sanity checks (F) and redzoning (Z).
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
## Zero memory at allocation and free time.
if dpkg --compare-versions "$kver" ge "5.3"; then if dpkg --compare-versions "$kver" ge "5.3"; then
## Enables sanity checks (F) and redzoning (Z).
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
#echo "## $kver grater or equal 5.3: yes" #echo "## $kver grater or equal 5.3: yes"
## Zero memory at allocation and free time.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
else else
#echo "## $kver grater or equal 5.3: no" #echo "## $kver grater or equal 5.3: no"
## SLUB poisoning and page poisoning is used if the kernel ## SLUB poisoning and page poisoning is used if the kernel
## does not yet support init_on_{,alloc,free}. ## does not yet support init_on_{,alloc,free}.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=P" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZP"
if command -v "qubesdb-read" >/dev/null 2>&1 ; then if command -v "qubesdb-read" >/dev/null 2>&1 ; then
## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012 ## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012

1
etc/permission-hardening.d/30_default.conf
View File

@ -91,6 +91,7 @@ dbus-daemon-launch-helper matchwhitelist
/boot/ 0700 root root /boot/ 0700 root root
/etc/permission-hardening.d 0600 root root /etc/permission-hardening.d 0600 root root
/usr/local/etc/permission-hardening.d 0600 root root /usr/local/etc/permission-hardening.d 0600 root root
/lib/modules/ 0700 root root
###################################################################### ######################################################################
# SUID/SGID Removal # SUID/SGID Removal