diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg index 64d85a7..a7b0eec 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ b/etc/default/grub.d/40_kernel_hardening.cfg @@ -60,13 +60,6 @@ fi ## https://github.com/anthraxx/linux-hardened GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" -## Prevent kernel info leaks in console during boot. -## https://phabricator.whonix.org/T950 -## LANG=C str_replace is provided by package helper-scripts. -## Remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT because "quiet" must be first. -GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | LANG=C str_replace "quiet" "")" -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet loglevel=0" - ## Restrict access to debugfs since it can contain a lot of sensitive information. ## https://lkml.org/lkml/2020/7/16/122 ## https://github.com/torvalds/linux/blob/fb1201aececc59990b75ef59fca93ae4aa1e1444/Documentation/admin-guide/kernel-parameters.txt#L835-L848 diff --git a/etc/default/grub.d/41_quiet.cfg b/etc/default/grub.d/41_quiet.cfg new file mode 100644 index 0000000..ffe8883 --- /dev/null +++ b/etc/default/grub.d/41_quiet.cfg @@ -0,0 +1,9 @@ +## Copyright (C) 2019 - 2021 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Prevent kernel info leaks in console during boot. +## https://phabricator.whonix.org/T950 +## LANG=C str_replace is provided by package helper-scripts. +## Remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT because "quiet" must be first. +GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | LANG=C str_replace "quiet" "")" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet loglevel=0"