diff --git a/README.md b/README.md index 42fba56..55f6485 100644 --- a/README.md +++ b/README.md @@ -121,6 +121,9 @@ configuration file. - Disable merging of slabs with similar size, which reduces the risk of triggering heap overflows and limits influencing slab cache layout. +- Provide the option to enable sanity checks and red zoning via slab debugging. + Enabling this feature will implicitly disable kernel pointer hashing. + - Enable memory zeroing at both allocation and free time, which mitigates some use-after-free vulnerabilities by erasing sensitive information in memory. diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg index d34f0ca..fab54cf 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ b/etc/default/grub.d/40_kernel_hardening.cfg @@ -29,6 +29,20 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru ## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" +## Enable sanity checks and red zoning of slabs via debugging options to detect corruption. +## As a by product of debugging, this will implicitly disabling kernel pointer hashing. +## Enabling will therefore leak exact and all kernel memory addresses to root. +## Has the potential to cause a noticeable performance decrease. +## +## https://www.kernel.org/doc/html/latest/mm/slub.html +## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u +## https://gitlab.tails.boum.org/tails/tails/-/issues/19613 +## +## The default kernel setting will be utilized until provided sufficient evidence to modify. +## https://github.com/Kicksecure/security-misc/issues/253 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ" + ## Zero memory at allocation time and free time. ## Fills newly allocated pages, freed pages, and heap objects with zeros. ## Mitigates use-after-free exploits by erasing sensitive information in memory.