Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2026-01-04 22:25:32 -05:00
Code Issues Projects Releases Packages Wiki Activity

Provide option to enable AMD SEV-ES

Browse source
This commit is contained in:
raja-grewal 2025-12-11 14:11:26 +00:00 • committed by GitHub
parent 725565c42e
commit 6a17255307
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -255,6 +255,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## Enable AMD Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV).
## SME encrypts memory with a single key at the kernel level to protect against cold boot attacks.
## SEV extends SME to VMs by encrypting the memory of each with a unique key for guest isolation.
## SEV-ES (Encrypted State) extends SEV by encrypting each guests virtual CPU register state during VM exits.
## This is hardware-based encryption managed by the proprietary and closed-source AMD Platform Security Processor (PSP).
## Both require a compatible AMD CPU and support for SME to first be enabled in the BIOS/UEFI.
## Likely unavailable in consumer-grade AMD CPUs where Transparent SME (TSME) can be enabled in the BIOS/UEFI to achieve SME.
@ -273,6 +274,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_es=1"
## Prevent processes from writing to block devices that are mounted by filesystems.
## Enhances system stability and security by protecting against runaway privileged processes.