Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2026-01-18 03:28:45 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #325 from raja-grewal/hash_pointers

Browse source 
Docs detailing future improvements to `slab_debug`
This commit is contained in:
Patrick Schleizer 2025-10-10 06:50:46 -04:00 • committed by GitHub
commit 6cf8a623fe
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -193,6 +193,7 @@ Kernel space:
- Enable sanity checks and red zoning via slab debugging. This will implicitly
disable kernel pointer hashing, leaking very sensitive information to root.
Re-enabling hashed pointers will be possible when using Linux kernel >= 6.17.
- Enable memory zeroing at both allocation and free time, which mitigates some
use-after-free vulnerabilities by erasing sensitive information in memory.

10
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -39,8 +39,8 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## Enable sanity checks and red zoning of slabs via debugging options to detect corruption.
## As a by product of debugging, this will implicitly disabling kernel pointer hashing.
## Enabling will therefore leak exact and all kernel memory addresses to root.
## As a by product of debugging, this will implicitly disabling kernel pointer hashing unless manually re-enabled.
## Enabling this (for now) will therefore leak exact and all kernel memory addresses to root.
## Has the potential to cause a noticeable performance decrease.
##
## https://www.kernel.org/doc/html/latest/mm/slub.html
@ -48,9 +48,13 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## https://gitlab.tails.boum.org/tails/tails/-/issues/19613
## https://github.com/Kicksecure/security-misc/issues/253
##
## KSPP=yes
## KSPP=partial
## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG.
##
## TODO: Debian 14
## The first parameter is applicable when using Linux kernel >= 6.17 (retained here for future-proofing and completeness).
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX hash_pointers=always"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
## Zero memory at allocation time and free time.