/etc/default/grub.d/40_kernel_hardening.cfg fails to detect kernel upgrade

phabricator-migrator · February 19, 2024, 5:24pm

Information

ID: 945
PHID: PHID-TASK-nx3ggmysxg3sq3hjkmz6
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

kver="$(uname -r)"

Confuses running kernel vs installed (upgraded) kernel.

Maybe better:

dpkg-query --show --showformat='${Version}' linux-image-amd64

github.com

Kicksecure/security-misc/blob/master/etc/default/grub.d/40_kernel_hardening.cfg

## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

kpkg="linux-image-$(dpkg --print-architecture)" || true
kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true
#echo "## kver: $kver"

## Disables the merging of slabs of similar sizes.
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"

## Enables sanity checks (F) and redzoning (Z).
## Disabled due to kernel deciding to implicitly disable kernel pointer hashing
## https://github.com/torvalds/linux/commit/792702911f581f7793962fbeb99d5c3a1b28f4c3
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"

## Zero memory at allocation and free time.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"

## Machine check exception handler decides whether the system should panic or not based on the exception that happened.

This file has been truncated. show original

Comments

madaidan

2019-12-23 19:58:08 UTC

Patrick

2019-12-24 11:15:15 UTC