Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 12:56:23 -05:00
Code Issues Projects Releases Packages Wiki Activity

Set kpti=1

Browse source
This commit is contained in:
raja-grewal 2025-11-03 04:30:58 +00:00 • committed by GitHub
parent 5b97e7bd27
commit 5e87c9bea4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -156,6 +156,8 @@ CPU mitigations:
- Spectre Side Channels (BTI and BHI)
- Meltdown
- Speculative Store Bypass (SSB)
- L1 Terminal Fault (L1TF)

14
etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared
View file

@ -71,6 +71,20 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on"
## Meltdown:
## Mitigate Spectre Variant 3 using kernel page table isolation (PTI).
## Force enable PTI of user and kernel address spaces on all cores.
## Mitigations for X86_64 CPUs are done in /etc/default/grub.d/40_kernel_hardening.cfg using "pti=on".
## Currently affects ARM64 CPUs.
##
## https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)
## https://en.wikipedia.org/wiki/Kernel_page-table_isolation
##
## KSPP=yes
## KSPP sets CONFIG_UNMAP_KERNEL_AT_EL0=y.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kpti=1"
## Speculative Store Bypass (SSB):
## Mitigate Spectre Variant 4 by disabling speculative store bypass system-wide.
## Unconditionally enable the mitigation for both kernel and userspace.