diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg index be234e5..d1b2038 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ b/etc/default/grub.d/40_kernel_hardening.cfg @@ -1,11 +1,11 @@ # Disables the merging of slabs of similar sizes. Sometimes a slab can be used in a vulnerable way which an attacker can exploit. GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" -# Enables sanity checks (F), redzoning (Z) and poisoning (P). +# Enables sanity checks (F), redzoning (Z) and poisoning (P). GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZP" -# Wipes free memory so it can't leak in various ways and prevents some use-after-free vulnerabilites. +# Wipes free memory so it can't leak in various ways and prevents some use-after-free vulnerabilites. GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1" -# Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. +# Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" diff --git a/etc/sysctl.d/kptr_restrict.conf b/etc/sysctl.d/kptr_restrict.conf index a6f46cd..f1bbc0e 100644 --- a/etc/sysctl.d/kptr_restrict.conf +++ b/etc/sysctl.d/kptr_restrict.conf @@ -1,2 +1,2 @@ -# Hides kernel symbols in /proc/kallsyms -kernel.kptr_restrict=2 +# Hides kernel symbols in /proc/kallsyms +kernel.kptr_restrict=2