diff --git a/README.md b/README.md index db4fe8e..0e1cf1b 100644 --- a/README.md +++ b/README.md @@ -68,9 +68,6 @@ use-after-free vulnerabilities and erase sensitive information in memory. * Page allocator freelist randomization is enabled. -* The machine check tolerance level is decreased which makes the kernel panic -on uncorrectable errors in ECC memory that could be exploited. - * Kernel Page Table Isolation is enabled to mitigate Meltdown and increase KASLR effectiveness. diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg index 5f8476e..30dd19a 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ b/etc/default/grub.d/40_kernel_hardening.cfg @@ -17,8 +17,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" ## Zero memory at allocation and free time. GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1" -## Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" +## Machine check exception handler decides whether the system should panic or not based on the exception that happened. +## https://forums.whonix.org/t/kernel-hardening/7296/494 +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" ## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR. GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"