linux-security/boot_parameters.sh at main · HenryRabelo/linux-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#!/bin/bash

# Add to the GRUB_CMDLINE_LINUX_DEFAULT line in /etc/grub/
# Reference: https://github.com/Kicksecure/security-misc/tree/master/etc/default/grub.d

# Enable Kernel Lockdown in Confidentiality Mode (Enforces Kernel Module Signing)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
lockdown=confidentiality"

# Prevent Logging During Boot (Needs 'kernel.printk' SysCtl)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
quiet loglevel=0"

# Disable DebugFS (Sensitive Information Exposure; Automatic in Lockdown Mode)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
debugfs=off"

# Enable Zeroing of Memory when Allocating and Freeing
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
init_on_alloc=1 init_on_free=1"

# Randomize Page Allocator Freelist
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
page_alloc.shuffle=1"

# Randomize Kernel Stack Offset
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
randomize_kstack_offset=on"

# Disable VSysCalls (Obsolete / Fixed Address)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
vsyscall=none"

# Disable Merging of Slabs of Similar Sizes
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
slab_nomerge"

# Distrust CPU for Initial Entropy at Boot (Disable RDRAND)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
random.trust_cpu=off"

# Distrust Bootloader for Initial Entropy at Boot
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
random.trust_bootloader=off"

# Enable IOMMU for all x86 CPU
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
intel_iommu=on amd_iommu=on"

# Enable Strict Enforcement of IOMMU TLB Invalidation
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
iommu.passthrough=0 iommu.strict=1"

# Disable BusMaster During Early Boot (IOMMU Complement)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
efi=disable_early_pci_dma"

# Enable Kernel Page Table Isolation (Meltdown Mitigation / Improved KASLR)
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX \
pti=on"

echo $GRUB_CMDLINE_LINUX