Browse code
linux-secure: extra KSPP hardening
1. slab_nomerge cmdline
2. disable /proc/kcore
Change-Id: Ic1b612303ff2e7ee4775acc544cd26e0f1eab9a2
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4908
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Srivatsa S. Bhat <srivatsab@vmware.com>
Alexey Makhalov authored on 2018/03/20 09:24:39Showing 2 changed files
| ... | ... |
@@ -2,7 +2,7 @@ |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux-secure |
| 4 | 4 |
Version: 4.9.80 |
| 5 |
-Release: 1%{?kat_build:.%kat_build}%{?dist}
|
|
| 5 |
+Release: 2%{?kat_build:.%kat_build}%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| ... | ... |
@@ -263,7 +263,7 @@ cp -v vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{uname_r}/vmlinux-%{uname_
|
| 263 | 263 |
# because .ko files will be loaded from the memory (LoadPin: obj=<unknown>) |
| 264 | 264 |
cat > %{buildroot}/boot/linux-%{uname_r}.cfg << "EOF"
|
| 265 | 265 |
# GRUB Environment Block |
| 266 |
-photon_cmdline=init=/lib/systemd/systemd ro loglevel=3 quiet no-vmw-sta loadpin.enabled=0 slub_debug=P page_poison=1 |
|
| 266 |
+photon_cmdline=init=/lib/systemd/systemd ro loglevel=3 quiet no-vmw-sta loadpin.enabled=0 slub_debug=P page_poison=1 slab_nomerge |
|
| 267 | 267 |
photon_linux=vmlinuz-%{uname_r}
|
| 268 | 268 |
photon_initrd=initrd.img-%{uname_r}
|
| 269 | 269 |
EOF |
| ... | ... |
@@ -326,6 +326,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
|
| 326 | 326 |
/usr/src/linux-headers-%{uname_r}
|
| 327 | 327 |
|
| 328 | 328 |
%changelog |
| 329 |
+* Mon Mar 18 2018 Alexey Makhalov <amakhalov@vmware.com> 4.9.80-2 |
|
| 330 |
+- Extra hardening: slab_nomerge, disable /proc/kcore |
|
| 329 | 331 |
* Mon Feb 05 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.80-1 |
| 330 | 332 |
- Update to version 4.9.80 |
| 331 | 333 |
* Wed Jan 31 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.79-1 |