Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Provide option to enable the kernel Electric-Fence

Browse Source
This commit is contained in:
Raja Grewal 2024-08-03 00:12:50 +10:00
parent f6a16258a1
commit 9099ecce8a
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -141,6 +141,10 @@ configuration file.
- Provide the option to modify machine check exception handler.
- Provide the option to enable the kernel Electric-Fence sampling-based memory
safety error detector which can identify heap out-of-bounds access, use-after-free,
and invalid-free errors.
- Provide the option to use kCFI as the default CFI implementation since it may be
slightly more resilient to attacks that are able to write arbitrary executables
in memory (when using Linux kernel version >= 6.2).

9
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -113,6 +113,15 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet"
## Enable the kernel "Electric-Fence" sampling-based memory safety error detector.
## KFENCE detects heap out-of-bounds access, use-after-free, and invalid-free errors.
## Aims to have very low processing overhead at each sampling interval
## Sampling interval is set to occur every 100 milliseconds as per KSPP recommendation.
##
## https://www.kernel.org/doc/html/latest/dev-tools/kfence.html
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kfence.sample_interval=100"
## Switch (back) to using kCFI as the default Control Flow Integrity (CFI) implementation.
## The default implementation is FIneIBT as of Linux kernel 6.2.
## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU.