Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 11:56:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

Set proc_mem.force_override=ptrace

Browse source
This commit is contained in:
raja-grewal 2025-11-03 00:48:49 +00:00 • committed by GitHub
parent 5b97e7bd27
commit 3fdfebc464
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -238,6 +238,9 @@ Kernel space:
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs - Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
and other persistent data to either the UEFI variable storage or ACPI ERST backends. and other persistent data to either the UEFI variable storage or ACPI ERST backends.
- Restrict processes from modifying their own memory mappings unless actively done via
`ptrace()` in order to limit self-modification which can trigger exploits.
Direct memory access: Direct memory access:
- Enable strict IOMMU translation to protect against some DMA attacks via the use - Enable strict IOMMU translation to protect against some DMA attacks via the use

13
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -237,6 +237,19 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## Restrict processes from modifying their own memory mappings.
## Prevents the use of FULL_FORCE by a processes unless via ptrace() for debugging.
## Limit self-modification which can be used trigger race condition vulnerabilities.
##
## https://lore.kernel.org/lkml/20240712-vfs-procfs-ce7e6c7cf26b@brauner/
## https://lwn.net/Articles/983169/
## https://github.com/a13xp0p0v/kernel-hardening-checker/pull/201
## https://github.com/Kicksecure/security-misc/issues/330
##
## Using "proc_mem.force_override=never" provides superior protection by never allowing overrides.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX proc_mem.force_override=ptrace"
## 2. Direct Memory Access: ## 2. Direct Memory Access:
## ##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks