Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-26 04:49:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

migrate ram-wipe to dedicated package

Browse Source
This commit is contained in:
Patrick Schleizer 2023-01-09 06:54:04 -05:00
parent ad5d0d4b12
commit 6faa050dd8
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 0 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
README.md
View File

@ -398,37 +398,6 @@ information that shouldn't be accessible to unprivileged users. As this will
break many things, it is disabled by default and can optionally be enabled by break many things, it is disabled by default and can optionally be enabled by
executing `systemctl enable hide-hardware-info.service` as root. executing `systemctl enable hide-hardware-info.service` as root.
## Cold Boot Attack Defense
Wiping RAM at shutdown to defeat cold boot attacks.
Implemented as `dracut` module `cold-boot-attack-defense`.
Requires `dracut`. In other words, RAM wipe is incompatible with systems
using `initramfs-tools`. To switch to, install dracut:
sudo apt update
sudo apt install --no-install-recommends dracut
`dracut` is intentionally not declared as a dependency of `security-misc` to
avoid making all of `security-misc` dependent on `dracut` only for the sake of
the wipe RAM at shutdown feature. Linux distribution such as Kicksecure are
advised to (and Kicksecure is planning to) install `dracut` instead of
`initramfs-tools` by default.
Only tested on `systemd` enabled systems.
User documentation:
https://www.kicksecure.com/wiki/Cold_Boot_Attack_Defense
Design documentation:
https://www.kicksecure.com/wiki/Dev/RAM_Wipe
Source code:
* `/usr/lib/dracut/modules.d/40cold-boot-attack-defense`
* `/etc/default/grub.d/40_cold_boot_attack_defense.cfg`
## miscellaneous ## miscellaneous
* hardened malloc compatibility for haveged workaround * hardened malloc compatibility for haveged workaround