Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-24 21:35:41 -05:00
Code Issues Projects Releases Packages Wiki Activity

Remove the option to reduce the MCE tolerance level

Browse source
This commit is contained in:
raja-grewal 2025-11-15 06:30:11 +00:00 • committed by GitHub
parent 9f897c5ccd
commit 29176d2ed2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 0 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -225,9 +225,6 @@ Kernel space:
- Force immediate system reboot on the occurrence of a single kernel panic, reducing the
risk and impact of denial-of-service attacks and both cold and warm boot attacks.
- Optional - Reduce the the Machine Check Exception (MCE) handler tolerance level to
always force kernel panics on any uncorrected hardware errors detected by the CPU.
- Prevent sensitive kernel information leaks in the console during boot.
- Enable the kernel Electric-Fence sampling-based memory safety error detector

19
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -161,25 +161,6 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off"
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic=-1"
## Reduce the Machine Check Exception (MCE) handler tolerance level.
## Machine checks report internal hardware error conditions detected by the CPU.
## Force the kernel to always panic on any uncorrected errors.
## Improves security using ECC memory against vulnerabilities like Rowhammer.
## Note current x86 CPUs generally do not allow recovery from MCEs.
## Must first be tested to ensure there are no pre-existing issues on user hardware.
## The default kernel setting should be utilized until provided sufficient evidence to modify.
##
## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/machinecheck.html
## https://www.kernel.org/doc/Documentation/x86/x86_64/boot-options.txt
## https://www.kernel.org/doc/Documentation/x86/x86_64/machinecheck
## https://en.wikipedia.org/wiki/Machine-check_exception#Linux
## https://groups.google.com/g/rowhammer-discuss/c/9Vgso6u2GP0
## https://forums.whonix.org/t/kernel-hardening/7296/494
##
## Note that this must be used with panic=-1 for it to function as intended.
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
## Prevent sensitive kernel information leaks in the console during boot.
## Must be used in combination with the kernel.printk sysctl.
## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation.