Kernel Hardening

Patrick · June 29, 2020, 9:32am

Then we need to update at same time debug-misc + documentation.

HulaHoop · June 29, 2020, 11:29am

Have you tested that? A number of software uses databases behind the scenes like mediawiki and discourse and bringing them to a crawl would destroy the usecase. Some IM clients use dbs too.

As long as documented then at least they will have a clue what needs to be done.

Patrick · September 19, 2020, 10:51am

What do you think?

madaidan · September 19, 2020, 11:24am

This one is fine. kernel.perf_event_paranoid=3 requires a kernel patch but some distros (such as Debian) includes this by default. If the patch isn’t used then it’ll be the same as setting it to 2.

https://patchwork.kernel.org/patch/9249919/

madaidan · September 28, 2020, 6:23pm

HulaHoop · October 3, 2020, 3:43pm

Interesting tool, anything that can contributed to it?

Patrick · October 3, 2020, 4:13pm

Was posted here: kernel recompilation for better hardening

Patrick · December 20, 2020, 10:24am

Patrick:

# Disable User Namespaces, as it opens up a large attack surface to unprivileged users.
# On Debian kernel.unprivileged_userns_clone is set to 0 by default as well
user.max_user_namespaces = 0

That comment needs an update.

debian bug report: Please reconsider enabling the user namespaces by default

It seems that next debian version will have unpriv user ns by default.

Patrick · January 5, 2021, 6:18am

Related to Linux kernel user namespaces:
Debian package bubblewrapwill set kernel.unprivileged_userns_clone=1 in Debian bullseye and above. bubblewrap will be no longer suid by default.

madaidan · January 12, 2021, 2:18am

Patrick · January 12, 2021, 8:30am

Great! Merged!

What do we do with debian/control?

(Used for apt-cache show security-misc, potentially packages.debian.org APT package repository web interface for deb.whonix.org) and README_generic.md?)

Simplify debian/control so it doesn’t have to be duplicated? Delete / avoid creation of README_generic.md?

madaidan · January 17, 2021, 1:42am

I think it should just contain a basic description and a link to the Github repository for more detailed information.