search

KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
82 stars 5 forks source link

Some fixes for the KSPP documentation (2) #363

Closed a13xp0p0v closed 2 months ago

a13xp0p0v commented 3 months ago

Hello!

1) There is one extra CONFIG_PAGE_TABLE_ISOLATION for the x86_32, which should be changed to the new CONFIG_MITIGATION_PAGE_TABLE_ISOLATION.

2) The CONFIG_PAGE_POISONING* recommendations should be updated. Starting from v5.11, CONFIG_PAGE_POISONING unconditionally checks the 0xAA poison pattern on allocation. That brings higher performance penalty and maybe not necessary for kernel self protection. What about recommending CONFIG_INIT_ON_FREE_DEFAULT_ON (introduced in v5.3) for new kernels or CONFIG_PAGE_POISONING_ZERO (removed in v5.11) for older kernels?

3) There is a kfence.sample_interval boot parameter. It should not be zero, similarly to CONFIG_KFENCE_SAMPLE_INTERVAL, which is recommended by the KSPP.

4) CONFIG_COMPAT_VDSO disabled ASLR of vDSO only on X86_64 and X86_32. On ARM64 this option has different meaning. So this recommendation should be moved to arch-specific part.

Thanks!

kees commented 3 months ago

Hi! Thanks for the recommendations. I've finally managed to port all of the wiki over to github pages, so the recommended settings are now here:

https://kspp.github.io/Recommended_Settings

From there it should now be possible to do edits and suggest PRs, etc. Wheee. Do you want to take a stab at being the first PR?

a13xp0p0v commented 2 months ago

Sure! Done: https://github.com/KSPP/kspp.github.io/pull/1.

kees commented 2 months ago

Merged, thanks!