Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2026-01-14 20:21:00 -05:00
Code Issues Projects Releases Packages Wiki Activity

Enable SME and SEV in supported AMD processors

Browse source
This commit is contained in:
raja-grewal 2025-12-24 05:22:06 +00:00 • committed by GitHub
parent d2796afe8e
commit 4ce0394fd0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -262,8 +262,8 @@ Kernel space:
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
and other persistent data to either the UEFI variable storage or ACPI ERST backends.
- Optional - On compatible AMD CPUs enable Secure Memory Encryption (SME) to protect against
cold boot attacks and Secure Encrypted Virtualization (SEV) for further guest memory isolation.
- On compatible AMD CPUs enable Secure Memory Encryption (SME) to protect against cold boot
attacks and Secure Encrypted Virtualization (SEV) for further guest memory isolation.
- Prevent runaway privileged processes from writing to block devices that are mounted by
filesystems to protect against filesystem corruption and kernel crashes.

8
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -299,10 +299,10 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## https://github.com/secureblue/secureblue/pull/1631#issuecomment-3655501478
## https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_es=1"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_snp=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_es=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_snp=1"
## Prevent processes from writing to block devices that are mounted by filesystems.
## Enhances system stability and security by protecting against runaway privileged processes.