From 02e8888b0bc4f0dfadccbebc9e6e75849d32ba76 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Sun, 5 May 2019 20:17:33 +0000
Subject: [PATCH] Update 40_kernel_hardening.cfg

---
 etc/default/grub.d/40_kernel_hardening.cfg | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg
index 0a39fa9..be234e5 100644
--- a/etc/default/grub.d/40_kernel_hardening.cfg
+++ b/etc/default/grub.d/40_kernel_hardening.cfg
@@ -1,2 +1,11 @@
 # Disables the merging of slabs of similar sizes. Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
+
+# Enables sanity checks (F), redzoning (Z) and poisoning (P). 
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZP"
+
+# Wipes free memory so it can't leak in various ways and prevents some use-after-free vulnerabilites. 
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1"
+
+# Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. 
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"