Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-24 21:35:41 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge 62dc2d4483 into 9f85a78c99

Browse source
This commit is contained in:
raja-grewal 2025-11-20 18:07:36 +11:00 • committed by GitHub
commit a12262d06c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -238,6 +238,9 @@ Kernel space:
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
and other persistent data to either the UEFI variable storage or ACPI ERST backends.
- Optional - On compatible AMD CPUs enable Secure Memory Encryption (SME) to protect against
cold boot attacks and Secure Encrypted Virtualization (SEV) for further guest memory isolation.
Direct memory access:
- Enable strict IOMMU translation to protect against some DMA attacks via the use

22
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -237,6 +237,28 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## Enable AMD Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV).
## SME encrypts memory with a single key at the kernel level to protect against cold boot attacks.
## SEV extends SME to VMs by encrypting the memory of each with a unique key for guest isolation.
## This is hardware-based encryption managed by the proprietary and closed-source AMD Platform Security Processor (PSP).
## Both require a compatible AMD CPU and support for SME to first be enabled in the BIOS/UEFI.
## Likely unavailable in consumer-grade AMD CPUs where Transparent SME (TSME) can be enabled in the BIOS/UEFI to achieve SME.
## Note the corresponding Intel Total Memory Encryption (TME) can also be enabled via the BIOS/UEFI.
## May cause boot failure on certain hardware with incompatible DMA masks.
##
## https://www.kernel.org/doc/html/next/x86/amd-memory-encryption.html
## https://www.kernel.org/doc/html/latest/virt/kvm/x86/amd-memory-encryption.html
## https://docs.amd.com/v/u/en-US/memory-encryption-white-paper
## https://docs.amd.com/v/u/en-US/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more
## https://en.wikichip.org/wiki/x86/sme
## https://lore.kernel.org/lkml/YWvy9bSRaC+m1sV+@zn.tnic/T/#m01bcb37040b6b0d119d385d9a34b9c7ac4ce5f84
## https://mricher.fr/post/amd-memory-encryption/
## https://www.kicksecure.com/wiki/Dev/confidential_computing#AMD
## https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on"
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1"
## 2. Direct Memory Access:
##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks