From 13cc1f0986033855a399b50442a86a8d8552eb96 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Thu, 18 Jul 2024 12:25:00 +1000 Subject: [PATCH] Clarify (future) disabling of `io_uring` --- README.md | 3 ++- usr/lib/sysctl.d/990-security-misc.conf | 8 +++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6e19e2f..5cd9fad 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,8 @@ space, user space, core dumps, and swap space. - Randomize the addresses (ASLR) for mmap base, stack, VDSO pages, and heap. -- Disable asynchronous I/O (when using Linux kernel version >= 6.6). +- Provide the option to disable asynchronous I/O as `io_uring` has been the source + of numerous kernel exploits (when using Linux kernel version >= 6.6). - Restrict usage of `ptrace()` to only processes with `CAP_SYS_PTRACE` as it enables programs to inspect and modify other active processes. Provide the diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf index 60440e5..e302047 100644 --- a/usr/lib/sysctl.d/990-security-misc.conf +++ b/usr/lib/sysctl.d/990-security-misc.conf @@ -117,12 +117,18 @@ kernel.perf_event_paranoid=3 kernel.randomize_va_space=2 ## Disable asynchronous I/O for all processes. +## Leading cause of numerous kernel exploits. +## Disabling will reduce the read/write performance of storage devices. ## +## https://en.wikipedia.org/wiki/Io_uring#Security +## https://lwn.net/Articles/902466/ ## https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html +## https://github.com/moby/moby/pull/46762 +## https://forums.whonix.org/t/io-uring-security-vulnerabilties/16890 ## ## Applicable when using Linux kernel >= 6.6 (retained here for future-proofing and completeness). ## -kernel.io_uring_disabled=2 +#kernel.io_uring_disabled=2 ## 2. User Space: ##