kernel recompilation for better hardening

[Patrick]

@madaidan

Does this make things more fragile, likely to break? Speculate not many people built-in virtualbox guest addition modules or other modules.

Not sure.

In doubt lets start simple, see how things go and more hardening later? Otherwise, if someone experiences instability, it may be hard to pinpoint what the cause is.

@madaidan

As of now, not all modules are load all the time. But without module load support, is everything load all the time?

I think so. Not sure.

That might actually be less secure then.

@madaidan

Or non-virtualbox VMs are just to bite the bullet of having a useless built-in module?

Yes. The built-in module doesn’t add much and shouldn’t be a problem for non-virtualbox VMs.

This will probably be contested.

@madaidan

This kernel won’t be able to be used on hosts. Otherwise we’d need to enable all hardware config options which would drastically increase the time needed to compile and add attack surface.

This is for VMs only.

Understood. Makes sense. Package name: hardened-vm-kernel or something like that? (“hardened vm kernel” might have some search results, hopefully we’re not reinventing here. I remember Ubuntu years ago had a VM specialized kernel.)

@madaidan

We can make a kernel for hosts if you want which would be separate from VMs but that’d take too long to compile and won’t be able to be compiled during package upgrades. It’d have to be pre-compiled.

Yes.

@madaidan

Do we gain security by using a kernel without module support compared to non-module support?

Yes, it prevents loading any module to add attack surface or load a malicious module.

Module loading requires root. “trusted” root. But root could as well as modify the kernel on the disk so next reboot something else will be booted? This would be far more useful if at reboot there was an integrity check which would refuse to boot any tampered kernel images. Related to verified boot:

• Verified Boot - Kicksecure
• enable Linux kernel gpg verification in grub and/or enable Secure Boot by default

As an alternative to make all modules built-in rather than dynamically load… What about loading all modules at early boot time and then disabling module loading? Would that be as good as disabling module loading at kernel compile time?