Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-12 00:39:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

comments

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-23 05:00:35 -05:00
parent bef41a38c2
commit 3e131174d5
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -2,6 +2,7 @@
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
kver="$(uname -r)" kver="$(uname -r)"
#echo "## kver: $kver"
## Disables the merging of slabs of similar sizes. ## Disables the merging of slabs of similar sizes.
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit. ## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
@ -11,9 +12,11 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
## Zero memory at allocation and free time. ## Zero memory at allocation and free time.
if dpkg --compare-versions "${kver}" ge "5.3"; then if dpkg --compare-versions "$kver" ge "5.3"; then
#echo "## $kver grater or equal 5.3: yes"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
else else
#echo "## $kver grater or equal 5.3: no"
## SLUB poisoning and page poisoning is used if the kernel ## SLUB poisoning and page poisoning is used if the kernel
## does not yet support init_on_{,alloc,free}. ## does not yet support init_on_{,alloc,free}.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=P" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=P"