Kernel Hardening - security-misc

[Patrick]

@raja

Perhaps we should include and comment out

randomize_kstack_offset=on

See :
LKML: Elena Reshetova: [RFC PATCH] x86/entry/64: randomize kernel stack offset upon syscall

Yes, please. Also add the links please.

Why commented out?

@raja

slub_debug=FZ

should perhaps be disabled due to:

Yes, please comment out and add the comment.

@raja

@Patrick

It’s kernel command line as source of randomness.

Using the command line as source is a very interesting idea and would definitely help. Has any progress been made on its development?

No progress unfortunately. If there is, I try to always keep the related forum threads (or preferably wiki if already there) updated.

@raja

Regarding entropy, I am very far from an expert on its unbiased generation, regardless, I was under the impression that since kernel v5.4 and v5.6 it is pretty ok by default.

Yeah. Complex topic.
Related:

Moar Entropy Sources

consider installing jitterentropy-rngd to improve entropy collection · Issue #4169 · QubesOS/qubes-issues · GitHub consider installing jitterentropy-rngd to improve entropy collection · Issue #4169 · QubesOS/qubes-issues · GitHub