From 3926b91dcf371377d38c747e5c7718ac2fed3c83 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Thu, 25 Jul 2024 10:26:23 +1000 Subject: [PATCH] Add documentation on `sysctl kernel.panic_on_oops=1` --- README.md | 3 +++ usr/lib/sysctl.d/990-security-misc.conf | 11 +++++++++++ 2 files changed, 14 insertions(+) diff --git a/README.md b/README.md index 5e029c8..e28549f 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,9 @@ space, user space, core dumps, and swap space. - Restrict kernel profiling and the performance events system to `CAP_PERFMON`. +- Force the kernel to panic on "oopses" that can potentially indicate and thwart + certain kernel exploitation attempts. + - Randomize the addresses (ASLR) for mmap base, stack, VDSO pages, and heap. - Disable asynchronous I/O as `io_uring` has been the source diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf index 7b07033..b05b3bf 100644 --- a/usr/lib/sysctl.d/990-security-misc.conf +++ b/usr/lib/sysctl.d/990-security-misc.conf @@ -109,6 +109,17 @@ kernel.sysrq=0 ## kernel.perf_event_paranoid=3 +## Force the kernel to panic on "oopses". +## Can sometimes potentially indicate and thwart certain kernel exploitation attempts. +## Also cause panics on machine check exceptions. +## Panics may be due to false-positives such as bad drivers. +## +## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 +## +## See /usr/libexec/security-misc/panic-on-oops for implementation. +## +#kernel.panic_on_oops=1 + ## Enable ASLR for mmap base, stack, VDSO pages, and heap. ## Heap randomization can lead to breakages with legacy applications. ##