Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-13 19:59:29 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #113 from raja-grewal/master

Browse Source 
Comment out machine check exception
This commit is contained in:
Patrick Schleizer 2022-08-22 06:09:40 -04:00 committed by GitHub
commit ae4d4989b0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -68,9 +68,6 @@ use-after-free vulnerabilities and erase sensitive information in memory.
* Page allocator freelist randomization is enabled.
* The machine check tolerance level is decreased which makes the kernel panic
on uncorrectable errors in ECC memory that could be exploited.
* Kernel Page Table Isolation is enabled to mitigate Meltdown and increase
KASLR effectiveness.

5
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -17,8 +17,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## Zero memory at allocation and free time.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
## Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
## Machine check exception handler decides whether the system should panic or not based on the exception that happened.
## https://forums.whonix.org/t/kernel-hardening/7296/494
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"