Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 12:56:23 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge e43d4d7f71 into fb587f78fd

Browse source
This commit is contained in:
raja-grewal 2025-11-10 23:15:50 +01:00 • committed by GitHub
commit f5d6aad792
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -238,6 +238,9 @@ Kernel space:
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs - Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
and other persistent data to either the UEFI variable storage or ACPI ERST backends. and other persistent data to either the UEFI variable storage or ACPI ERST backends.
- Prevent runaway privileged processes from writing to block devices that are mounted by
filesystems to protect against filesystem corruption and kernel crashes.
Direct memory access: Direct memory access:
- Enable strict IOMMU translation to protect against some DMA attacks via the use - Enable strict IOMMU translation to protect against some DMA attacks via the use

12
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -237,6 +237,18 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## Prevent processes from writing to block devices that are mounted by filesystems.
## Enhances system stability and security by protecting against runaway privileged processes.
## Allowing processes to write to the buffer cache can cause filesystem corruption and kernel crashes.
## Does not prevent data modifications using direct SCSI commands or lower-level storage stack access.
## May lead to breakages in certain limited scenarios.
##
## https://github.com/torvalds/linux/commit/ed5cc702d311c14b653323d76062b0294effa66e
## https://lore.kernel.org/lkml/20240105-vfs-super-4092d802972c@brauner/
## https://github.com/a13xp0p0v/kernel-hardening-checker/issues/186
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX bdev_allow_write_mounted=0"
## 2. Direct Memory Access: ## 2. Direct Memory Access:
## ##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks