Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #257 from raja-grewal/slab_debug

Browse Source 
Enable `slab_debug=FZ`
This commit is contained in:
Patrick Schleizer 2024-08-06 09:39:04 -04:00 committed by GitHub
commit b0278428a7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -121,8 +121,8 @@ configuration file.
- Disable merging of slabs with similar size, which reduces the risk of - Disable merging of slabs with similar size, which reduces the risk of
triggering heap overflows and limits influencing slab cache layout. triggering heap overflows and limits influencing slab cache layout.
- Provide the option to enable sanity checks and red zoning via slab debugging. - Enable sanity checks and red zoning via slab debugging. This will implicitly
Enabling this feature will implicitly disable kernel pointer hashing. disable kernel pointer hashing, leaking very sensitive information to root.
- Enable memory zeroing at both allocation and free time, which mitigates some - Enable memory zeroing at both allocation and free time, which mitigates some
use-after-free vulnerabilities by erasing sensitive information in memory. use-after-free vulnerabilities by erasing sensitive information in memory.

4
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -37,11 +37,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## https://www.kernel.org/doc/html/latest/mm/slub.html ## https://www.kernel.org/doc/html/latest/mm/slub.html
## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u ## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
## https://gitlab.tails.boum.org/tails/tails/-/issues/19613 ## https://gitlab.tails.boum.org/tails/tails/-/issues/19613
##
## The default kernel setting will be utilized until provided sufficient evidence to modify.
## https://github.com/Kicksecure/security-misc/issues/253 ## https://github.com/Kicksecure/security-misc/issues/253
## ##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
## Zero memory at allocation time and free time. ## Zero memory at allocation time and free time.
## Fills newly allocated pages, freed pages, and heap objects with zeros. ## Fills newly allocated pages, freed pages, and heap objects with zeros.