Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #257 from raja-grewal/slab_debug

Browse Source 
Enable `slab_debug=FZ`
This commit is contained in:
Patrick Schleizer 2024-08-06 09:39:04 -04:00 committed by GitHub
commit b0278428a7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -121,8 +121,8 @@ configuration file.
- Disable merging of slabs with similar size, which reduces the risk of
triggering heap overflows and limits influencing slab cache layout.
- Provide the option to enable sanity checks and red zoning via slab debugging.
Enabling this feature will implicitly disable kernel pointer hashing.
- Enable sanity checks and red zoning via slab debugging. This will implicitly
disable kernel pointer hashing, leaking very sensitive information to root.
- Enable memory zeroing at both allocation and free time, which mitigates some
use-after-free vulnerabilities by erasing sensitive information in memory.

4
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -37,11 +37,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## https://www.kernel.org/doc/html/latest/mm/slub.html
## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
## https://gitlab.tails.boum.org/tails/tails/-/issues/19613
##
## The default kernel setting will be utilized until provided sufficient evidence to modify.
## https://github.com/Kicksecure/security-misc/issues/253
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
## Zero memory at allocation time and free time.
## Fills newly allocated pages, freed pages, and heap objects with zeros.