Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-29 07:57:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Set efi_pstore.pstore_disable=1

Browse source
This commit is contained in:
raja-grewal 2025-03-16 03:30:04 +00:00 • committed by GitHub
parent f643ebc2f9
commit df2fc2cf6b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -226,6 +226,9 @@ Kernel space:
- Optional - Disable support for all x86 processes and syscalls (when using Linux kernel >= 6.7) - Optional - Disable support for all x86 processes and syscalls (when using Linux kernel >= 6.7)
to reduce attack surface. to reduce attack surface.
- Disable EFI persistent storage feature, preventing the kernel from writing crash logs and
other persistent data to the EFI variable store.
Direct memory access: Direct memory access:
- Enable strict IOMMU translation to protect against some DMA attacks via the use - Enable strict IOMMU translation to protect against some DMA attacks via the use

12
etc/default/grub.d/40_kernel_hardening.cfg
View file

@ -223,6 +223,18 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
## ##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0" #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
## Disable EFI persistent storage feature.
## Prevents the kernel from writing crash logs and other persistent data to the EFI variable store.
##
## https://blogs.oracle.com/linux/post/pstore-linux-kernel-persistent-storage-file-system
## https://www.ais.com/understanding-pstore-linux-kernel-persistent-storage-file-system/
## https://lwn.net/Articles/434821/
## https://manpages.debian.org/testing/systemd/systemd-pstore.service.8.en.html
## https://gitlab.tails.boum.org/tails/tails/-/issues/20813
## https://github.com/Kicksecure/security-misc/issues/299
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
## 2. Direct Memory Access: ## 2. Direct Memory Access:
## ##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks