Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-24 05:57:24 -05:00
commit d03a3d9ac0
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -1,25 +1,25 @@
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
kver="$(uname -r)"
kver="$(dpkg-query --show --showformat='${Version}' linux-image-amd64)"
#echo "## kver: $kver"
## Disables the merging of slabs of similar sizes.
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## Enables sanity checks (F) and redzoning (Z).
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
## Zero memory at allocation and free time.
if dpkg --compare-versions "$kver" ge "5.3"; then
## Enables sanity checks (F) and redzoning (Z).
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
#echo "## $kver grater or equal 5.3: yes"
## Zero memory at allocation and free time.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
else
#echo "## $kver grater or equal 5.3: no"
## SLUB poisoning and page poisoning is used if the kernel
## does not yet support init_on_{,alloc,free}.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=P"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZP"
if command -v "qubesdb-read" >/dev/null 2>&1 ; then
## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012

1
etc/permission-hardening.d/30_default.conf
View File

@ -91,6 +91,7 @@ dbus-daemon-launch-helper matchwhitelist
/boot/ 0700 root root
/etc/permission-hardening.d 0600 root root
/usr/local/etc/permission-hardening.d 0600 root root
/lib/modules/ 0700 root root
######################################################################
# SUID/SGID Removal