kernel recompilation for better hardening

[Patrick]

Can any third party help to review hardened-vm-kernel? Could you submit this to GitHub - anthraxx/linux-hardened: Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.libera.chat #linux-hardening please?

@madaidan

I was thinking of only adding small patches that are split up and easy to look over. e.g. add GRKERNSEC_IO to disable-priv-io.patch .

Obviously we can’t maintain a forward port of all the patches but small ones like GRKERNSEC_IO would be easy to maintain.

Could you you please submit this please to Debian or Linux upstream? At least need to see someone else’s feedback.

@madaidan

How are we going to prevent an attacker from booting another kernel?

That’s the idea of verified boot.
(enable Linux kernel gpg verification in grub and/or enable Secure Boot by default)

@madaidan

E.g. attacker sees the hardened kernel, edits grub config file so it boots the ordinary kernel, reboots and then exploits some vulnerability the hardened kernel would prevent.

Or an attacker could do apt-get remove hardened-vm-kernel && reboot .

This can probably be solved though with the system apparmor profile but I’m not sure if that’s the best approach, especially since an attacker can just use apt-get as that has permissions to remove/update/install the kernel.

Indeed. I don’t see any substitute for verified boot. Anything else will either be limiting features (too much) and even then there might be clever ways to circumvent it.