mirror of
https://github.com/Kicksecure/security-misc.git
synced 2024-12-26 09:39:26 -05:00
27 lines
1.2 KiB
INI
27 lines
1.2 KiB
INI
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
|
## See the file COPYING for copying conditions.
|
|
|
|
## Disables the merging of slabs of similar sizes. Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
|
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
|
|
|
|
## Enables sanity checks (F), redzoning (Z) and poisoning (P).
|
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZP"
|
|
|
|
if command -v "qubesdb-read" >/dev/null 2>&1 ; then
|
|
## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012
|
|
true "skip adding page_poison=1 in Qubes"
|
|
else
|
|
## Wipes free memory so it can't leak in various ways and prevents some use-after-free vulnerabilites.
|
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1"
|
|
fi
|
|
|
|
## Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit.
|
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
|
|
|
|
## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR.
|
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
|
|
|
|
## Enables all mitigations for the MDS vulnerability.
|
|
## Disables smt which can be used to exploit the MDS vulnerability.
|
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"
|