Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #48 from madaidan/kernel-hardening

Browse Source 
Use only one slub_debug parameter
This commit is contained in:
Patrick Schleizer 2019-12-24 10:54:23 +00:00 committed by GitHub
commit 0c3d4ad255
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -8,18 +8,18 @@ kver="$(uname -r)"
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
if dpkg --compare-versions "$kver" ge "5.3"; then
## Enables sanity checks (F) and redzoning (Z).
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
## Zero memory at allocation and free time.
if dpkg --compare-versions "$kver" ge "5.3"; then
#echo "## $kver grater or equal 5.3: yes"
## Zero memory at allocation and free time.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
else
#echo "## $kver grater or equal 5.3: no"
## SLUB poisoning and page poisoning is used if the kernel
## does not yet support init_on_{,alloc,free}.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=P"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZP"
if command -v "qubesdb-read" >/dev/null 2>&1 ; then
## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012