Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 21:09:25 -05:00
Code Issues Projects Releases Packages Wiki Activity

Update docs on slab_debug for future improvements

Browse source
This commit is contained in:
raja-grewal 2025-10-08 02:39:20 +00:00 • committed by GitHub
parent 685070bd02
commit e89c7ae025
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -193,6 +193,7 @@ Kernel space:
- Enable sanity checks and red zoning via slab debugging. This will implicitly - Enable sanity checks and red zoning via slab debugging. This will implicitly
disable kernel pointer hashing, leaking very sensitive information to root. disable kernel pointer hashing, leaking very sensitive information to root.
Re-enabling hashed pointers will be possible when using Linux kernel >= 6.17.
- Enable memory zeroing at both allocation and free time, which mitigates some - Enable memory zeroing at both allocation and free time, which mitigates some
use-after-free vulnerabilities by erasing sensitive information in memory. use-after-free vulnerabilities by erasing sensitive information in memory.

10
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -39,8 +39,8 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## Enable sanity checks and red zoning of slabs via debugging options to detect corruption. ## Enable sanity checks and red zoning of slabs via debugging options to detect corruption.
## As a by product of debugging, this will implicitly disabling kernel pointer hashing. ## As a by product of debugging, this will implicitly disabling kernel pointer hashing unless manually re-enabled.
## Enabling will therefore leak exact and all kernel memory addresses to root. ## Enabling this (for now) will therefore leak exact and all kernel memory addresses to root.
## Has the potential to cause a noticeable performance decrease. ## Has the potential to cause a noticeable performance decrease.
## ##
## https://www.kernel.org/doc/html/latest/mm/slub.html ## https://www.kernel.org/doc/html/latest/mm/slub.html
@ -48,9 +48,13 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
## https://gitlab.tails.boum.org/tails/tails/-/issues/19613 ## https://gitlab.tails.boum.org/tails/tails/-/issues/19613
## https://github.com/Kicksecure/security-misc/issues/253 ## https://github.com/Kicksecure/security-misc/issues/253
## ##
## KSPP=yes ## KSPP=partial
## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG. ## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG.
## ##
## TODO: Debian 14
## The first parameter is applicable when using Linux kernel >= 6.17 (retained here for future-proofing and completeness).
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX hash_pointers=always"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
## Zero memory at allocation time and free time. ## Zero memory at allocation time and free time.