Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-26 18:46:29 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie

Browse source
This commit is contained in:
Aaron Rainbolt 2025-08-16 21:10:19 -05:00
commit 7a8dfa528c
No known key found for this signature in database
GPG key ID: A709160D73C79109
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -223,7 +223,7 @@ Kernel space:
- Use kCFI as the default CFI implementation as it is more resilient to attacks that are
able to write arbitrary executables into memory omitting the necessary hash validation.
- Optional - Disable support for all x86 processes and syscalls to reduce attack surface.
- Optional - Disable support for all 32-bit x86 processes and syscalls to reduce attack surface.
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
and other persistent data to either the UEFI variable storage or ACPI ERST backends.

2
etc/default/grub.d/40_kernel_hardening.cfg
View file

@ -206,7 +206,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi"
## Disable support for x86 processes and syscalls.
## Disable support for all 32-bit x86 processes and syscalls.
## Unconditionally disables IA32 emulation to substantially reduce attack surface.
##
## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/