Skip to content

Provide more useful comments #326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
colleirose wants to merge 1 commit into from
Closed

Provide more useful comments #326

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 33 additions & 32 deletions etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,33 +34,44 @@
## https://uefi.org/revocationlistfile
## https://github.com/fwupd/fwupd

## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT.
##
## KSPP=yes
## KSPP sets the kernel parameters.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"

## Disable SMT as it has been the cause of and amplified numerous CPU exploits.
## Disable SMT as it has been the cause of and amplified numerous CPU exploits that would allow a sandboxed program or VM to infer contents from the host.
## The only full mitigation of cross-HT attacks is to disable SMT.
## Disabling will significantly decrease system performance on multi-threaded tasks.
## Disabling will significantly decrease system performance on multi-threaded tasks. If you need a performance increase, you can re-enable SMT at the cost of security.
##
## Note, this setting will prevent re-enabling SMT via the sysfs interface.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365
##
## KSPP=yes
## KSPP sets the kernel parameter.
##
## To re-enable SMT:
## - Remove "nosmt=force".
## - Remove "nosmt=force" below.
## - Remove all occurrences of ",nosmt" in this file (note the comma ",").
## - Downgrade "l1tf=full,force" protection to "l1tf=flush".
## - Regenerate the dracut initramfs and then reboot system.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"

## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT.
##
## KSPP=yes
## KSPP sets the kernel parameters.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"

## L1 Terminal Fault (L1TF):
## Mitigate the vulnerability by disabling L1D flush runtime control and SMT.
## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always"

## Spectre Side Channels (BTI and BHI):
## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection).
## Enable mitigation for the Intel branch history injection vulnerability.
Expand All @@ -82,33 +93,23 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on"

## L1 Terminal Fault (L1TF):
## Mitigate the vulnerability by disabling L1D flush runtime control and SMT.
## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always"

## Microarchitectural Data Sampling (MDS):
## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT.
## Mitigate the vulnerability by clearing the CPU buffer cache.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full"

## TSX Asynchronous Abort (TAA):
## Mitigate the vulnerability by disabling TSX.
## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT.
## If TSX is enabled, clear CPU buffer rings on transitions.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full"

## iTLB Multihit:
## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable.
Expand All @@ -134,23 +135,23 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"

## Processor MMIO Stale Data:
## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT.
## Mitigate the vulnerabilities by appropriately clearing the CPU buffer.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full"

## Arbitrary Speculative Code Execution with Return Instructions (Retbleed):
## Mitigate the vulnerability through CPU-dependent implementation and disable SMT.
## Mitigate the vulnerability through CPU-dependent implementation.
## Currently affects both AMD Zen 1-2 and Intel CPUs.
##
## https://en.wikipedia.org/wiki/Retbleed
## https://comsec.ethz.ch/research/microarch/retbleed/
## https://www.suse.com/support/kb/doc/?id=000020693
## https://access.redhat.com/solutions/retbleed
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto"

## Cross-Thread Return Address Predictions:
## Mitigate the vulnerability for certain KVM hypervisor configurations.
Expand Down
28 changes: 20 additions & 8 deletions etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,11 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1"
## Enable the kernel page allocator to randomize free lists.
## During early boot, the page allocator has predictable FIFO behavior for physical pages.
## Limits some data exfiltration and ROP attacks that rely on inferring sensitive data location.
## Also improves performance by optimizing memory-side cache utilization.
##
## There aren't any known CVEs that would be fully mitigated by this, but it still offers some small benefits without any major downsides.
## This can also slightly improve performance, with the biggest benefit on high-performance computing (HPC) and server systems, but it can reduce performance in some workloads.
##
## If you are experiencing performance issues, benchmarking with vs without this option can be a good place to start as it has only a small security impact.
##
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e900a918b0984ec8f2eb150b8477a47b75d17692
## https://en.wikipedia.org/wiki/Return-oriented_programming#Attacks
Expand Down Expand Up @@ -101,7 +105,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on"

## Disable vsyscalls to reduce attack surface as they have been replaced by vDSO.
## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory.
## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory, and are very rarely used.
##
## https://lwn.net/Articles/446528/
## https://en.wikipedia.org/wiki/VDSO
Expand Down Expand Up @@ -280,12 +284,19 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma"

## Do not credit the CPU or bootloader seeds as entropy sources at boot.
## The RDRAND CPU (RNG) instructions are proprietary and closed-source.
## Numerous implementations of RDRAND have a long history of being defective.
## The RNG seed passed by the bootloader could also potentially be tampered.
## Maximizing the entropy pool at boot is desirable for all cryptographic operations.
## These settings ensure additional entropy is obtained from other sources to initialize the RNG.
## Note that distrusting these (relatively fast) sources of entropy will increase boot time.
## Numerous implementations of RDRAND have a long history of being defective, and the RNG seed passed by the bootloader could potentially be tampered or unreliable.
##
## In recent years, the kernel has been reworked so that defective RDRAND instructions would have a limited effect on the RNG system,
## but we will disable it here anyway as a paranoia measure.
##
## This doesn't prevent the RDRAND output from being mixed into the entropy pool, it just prevents it from being credited.
## This is fine, though, because the Linux kernel always allows anything to be added to the entropy pool,
## but is designed in a way that unreliable data being mixed in won't have any effect.
##
## Note that distrusting these (relatively fast) sources of entropy may sometimes increase boot time.
## If you experience unreasonably slow boot times, you may wish to experiment with removing some of the below lines.
##
## https://lkml.org/lkml/2022/6/5/271
## https://en.wikipedia.org/wiki/RDRAND#Reception
## https://systemd.io/RANDOM_SEEDS/
## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND
Expand All @@ -294,7 +305,6 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma"
## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
## https://github.com/NixOS/nixpkgs/pull/165355
## https://lkml.org/lkml/2022/6/5/271
##
## KSPP=yes
## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y and CONFIG_RANDOM_TRUST_CPU=y.
Expand All @@ -305,6 +315,8 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
## Obtain more entropy during boot as the runtime memory allocator is being initialized.
## Entropy will be extracted from up to the first 4GB of RAM.
## Requires the linux-hardened kernel patch.
## This data isn't credited by linux-hardened because not all of it is cryptographically secure,
## but is mixed in as uncredited device randomness (which would usually include things like serial numbers, device configuration, current time, etc)
##
## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened
## https://github.com/anthraxx/linux-hardened/commit/c3e7df1dba1eb8105d6d5143079a6a0ad9e9ebc7
Expand Down