diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared index 8f18ad06..10b95005 100644 --- a/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared +++ b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared @@ -34,33 +34,44 @@ ## https://uefi.org/revocationlistfile ## https://github.com/fwupd/fwupd -## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT. -## -## KSPP=yes -## KSPP sets the kernel parameters. -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" - -## Disable SMT as it has been the cause of and amplified numerous CPU exploits. +## Disable SMT as it has been the cause of and amplified numerous CPU exploits that would allow a sandboxed program or VM to infer contents from the host. ## The only full mitigation of cross-HT attacks is to disable SMT. -## Disabling will significantly decrease system performance on multi-threaded tasks. +## Disabling will significantly decrease system performance on multi-threaded tasks. If you need a performance increase, you can re-enable SMT at the cost of security. +## ## Note, this setting will prevent re-enabling SMT via the sysfs interface. ## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html -## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 -## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365 -## ## KSPP=yes ## KSPP sets the kernel parameter. ## ## To re-enable SMT: -## - Remove "nosmt=force". +## - Remove "nosmt=force" below. ## - Remove all occurrences of ",nosmt" in this file (note the comma ","). ## - Downgrade "l1tf=full,force" protection to "l1tf=flush". ## - Regenerate the dracut initramfs and then reboot system. ## +## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 +## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365 +## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" +## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT. +## +## KSPP=yes +## KSPP sets the kernel parameters. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" + +## L1 Terminal Fault (L1TF): +## Mitigate the vulnerability by disabling L1D flush runtime control and SMT. +## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects Intel CPUs. +## +## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always" + ## Spectre Side Channels (BTI and BHI): ## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection). ## Enable mitigation for the Intel branch history injection vulnerability. @@ -82,33 +93,23 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on" -## L1 Terminal Fault (L1TF): -## Mitigate the vulnerability by disabling L1D flush runtime control and SMT. -## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations. -## Currently affects Intel CPUs. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always" - ## Microarchitectural Data Sampling (MDS): -## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT. +## Mitigate the vulnerability by clearing the CPU buffer cache. ## Currently affects Intel CPUs. ## ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html ## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full" ## TSX Asynchronous Abort (TAA): ## Mitigate the vulnerability by disabling TSX. -## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT. +## If TSX is enabled, clear CPU buffer rings on transitions. ## Currently affects Intel CPUs. ## ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html ## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off" -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full" ## iTLB Multihit: ## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable. @@ -134,15 +135,15 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on" ## Processor MMIO Stale Data: -## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT. +## Mitigate the vulnerabilities by appropriately clearing the CPU buffer. ## Currently affects Intel CPUs. ## ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html ## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full" ## Arbitrary Speculative Code Execution with Return Instructions (Retbleed): -## Mitigate the vulnerability through CPU-dependent implementation and disable SMT. +## Mitigate the vulnerability through CPU-dependent implementation. ## Currently affects both AMD Zen 1-2 and Intel CPUs. ## ## https://en.wikipedia.org/wiki/Retbleed @@ -150,7 +151,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" ## https://www.suse.com/support/kb/doc/?id=000020693 ## https://access.redhat.com/solutions/retbleed ## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto" ## Cross-Thread Return Address Predictions: ## Mitigate the vulnerability for certain KVM hypervisor configurations. diff --git a/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared index c4c8457e..b3335511 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared +++ b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared @@ -68,7 +68,11 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1" ## Enable the kernel page allocator to randomize free lists. ## During early boot, the page allocator has predictable FIFO behavior for physical pages. ## Limits some data exfiltration and ROP attacks that rely on inferring sensitive data location. -## Also improves performance by optimizing memory-side cache utilization. +## +## There aren't any known CVEs that would be fully mitigated by this, but it still offers some small benefits without any major downsides. +## This can also slightly improve performance, with the biggest benefit on high-performance computing (HPC) and server systems, but it can reduce performance in some workloads. +## +## If you are experiencing performance issues, benchmarking with vs without this option can be a good place to start as it has only a small security impact. ## ## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e900a918b0984ec8f2eb150b8477a47b75d17692 ## https://en.wikipedia.org/wiki/Return-oriented_programming#Attacks @@ -101,7 +105,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on" ## Disable vsyscalls to reduce attack surface as they have been replaced by vDSO. -## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory. +## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory, and are very rarely used. ## ## https://lwn.net/Articles/446528/ ## https://en.wikipedia.org/wiki/VDSO @@ -280,12 +284,19 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma" ## Do not credit the CPU or bootloader seeds as entropy sources at boot. ## The RDRAND CPU (RNG) instructions are proprietary and closed-source. -## Numerous implementations of RDRAND have a long history of being defective. -## The RNG seed passed by the bootloader could also potentially be tampered. -## Maximizing the entropy pool at boot is desirable for all cryptographic operations. -## These settings ensure additional entropy is obtained from other sources to initialize the RNG. -## Note that distrusting these (relatively fast) sources of entropy will increase boot time. +## Numerous implementations of RDRAND have a long history of being defective, and the RNG seed passed by the bootloader could potentially be tampered or unreliable. ## +## In recent years, the kernel has been reworked so that defective RDRAND instructions would have a limited effect on the RNG system, +## but we will disable it here anyway as a paranoia measure. +## +## This doesn't prevent the RDRAND output from being mixed into the entropy pool, it just prevents it from being credited. +## This is fine, though, because the Linux kernel always allows anything to be added to the entropy pool, +## but is designed in a way that unreliable data being mixed in won't have any effect. +## +## Note that distrusting these (relatively fast) sources of entropy may sometimes increase boot time. +## If you experience unreasonably slow boot times, you may wish to experiment with removing some of the below lines. +## +## https://lkml.org/lkml/2022/6/5/271 ## https://en.wikipedia.org/wiki/RDRAND#Reception ## https://systemd.io/RANDOM_SEEDS/ ## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND @@ -294,7 +305,6 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma" ## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html ## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566 ## https://github.com/NixOS/nixpkgs/pull/165355 -## https://lkml.org/lkml/2022/6/5/271 ## ## KSPP=yes ## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y and CONFIG_RANDOM_TRUST_CPU=y. @@ -305,6 +315,8 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" ## Obtain more entropy during boot as the runtime memory allocator is being initialized. ## Entropy will be extracted from up to the first 4GB of RAM. ## Requires the linux-hardened kernel patch. +## This data isn't credited by linux-hardened because not all of it is cryptographically secure, +## but is mixed in as uncredited device randomness (which would usually include things like serial numbers, device configuration, current time, etc) ## ## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened ## https://github.com/anthraxx/linux-hardened/commit/c3e7df1dba1eb8105d6d5143079a6a0ad9e9ebc7