ageis
commented
5 years ago Here is another popular script which is useful for auditing kernel configuration (among other things) for security: https://github.com/slimm609/checksec.sh
Example syntax:
checksec --format=cli --verbose --kernel=/boot/config-4.4.182-grsec
I have styled in bold those items which may need attention, but note they're based off my desktop rather than a SecureDrop server (I don't have the same sysctl settings or boot parameters).
-
Kernel protection information for : /boot/config-4.4.182-grsec
Description - List the status of kernel protection mechanisms. Rather than inspect kernel mechanisms that may aid in the prevention of exploitation of userspace processes, this option lists the status of kernel configuration options that harden the kernel itself against attack.
Kernel config: Warning: The config /home/kevin/dev/boot/config-4.4.182-grsec on disk may not represent running kernel config!
Vanilla Kernel ASLR: Full Protected symlinks: sysctl: permission denied on key 'fs.protected_symlinks' Disabled Protected hardlinks: sysctl: permission denied on key 'fs.protected_hardlinks' Disabled Ipv4 reverse path filtering: Enabled Ipv6 reverse path filtering: Disabled Kernel heap randomization: Enabled GCC stack protector support: Enabled GCC stack protector strong: Disabled Restrict /dev/mem access: Enabled Restrict I/O access to /dev/mem: Disabled Exec Shield: Disabled
-
X86 only:
Address space layout randomization: Enabled -
SELinux: Disabled
SELinux infomation available here: http://selinuxproject.org/
-
grsecurity / PaX: Auto GRKERNSEC
Non-executable kernel pages: Enabled Non-executable pages: Enabled Paging Based Non-executable pages: Enabled Restrict MPROTECT: Enabled Address Space Layout Randomization: Enabled Randomize Kernel Stack: Enabled Randomize User Stack: Enabled Randomize MMAP Stack: Enabled Sanitize freed memory: Enabled Sanitize Kernel Stack: Enabled Prevent userspace pointer deref: Enabled Prevent kobject refcount overflow: Enabled Bounds check heap object copies: Enabled JIT Hardening: Disabled Thread Stack Random Gaps: Enabled Disable writing to kmem/mem/port: Enabled Disable privileged I/O: Enabled Harden module auto-loading: Enabled Chroot Protection: Enabled Deter ptrace process snooping: Enabled Larger Entropy Pools: Disabled TCP/UDP Blackhole: Enabled Deter Exploit Bruteforcing: Enabled Hide kernel symbols: Enabled Pax softmode: Disabled Grsec sysctl options: grsecurity.audit_chdir: Disabled grsecurity.audit_gid: Disabled grsecurity.audit_group: Disabled grsecurity.audit_mount: Disabled grsecurity.audit_ptrace: Disabled grsecurity.chroot_caps: Disabled grsecurity.chroot_deny_bad_rename: Disabled grsecurity.chroot_deny_chmod: Disabled grsecurity.chroot_deny_chroot: Disabled grsecurity.chroot_deny_fchdir: Disabled grsecurity.chroot_deny_mknod: Disabled grsecurity.chroot_deny_mount: Disabled grsecurity.chroot_deny_pivot: Disabled grsecurity.chroot_deny_shmat: Disabled grsecurity.chroot_deny_sysctl: Disabled grsecurity.chroot_deny_unix: Disabled grsecurity.chroot_enforce_chdir: Disabled grsecurity.chroot_execlog: Disabled grsecurity.chroot_findtask: Disabled grsecurity.chroot_restrict_nice: Disabled grsecurity.consistent_setxid: Disabled grsecurity.deny_new_usb: Disabled grsecurity.deter_bruteforce: Disabled grsecurity.disable_priv_io: Disabled grsecurity.dmesg: Disabled grsecurity.enforce_symlinksifowner: Disabled grsecurity.exec_logging: Disabled grsecurity.fifo_restrictions: Disabled grsecurity.forkfail_logging: Disabled grsecurity.grsec_lock: Disabled grsecurity.harden_ipc: Disabled grsecurity.harden_ptrace: Disabled grsecurity.ip_blackhole: Disabled grsecurity.lastack_retries: Disabled grsecurity.linking_restrictions: Disabled grsecurity.ptrace_readexec: Disabled grsecurity.resource_logging: Disabled grsecurity.romount_protect: Disabled grsecurity.rwxmap_logging: Disabled grsecurity.signal_logging: Disabled grsecurity.socket_all: Disabled grsecurity.socket_all_gid: Disabled grsecurity.socket_client: Disabled grsecurity.socket_client_gid: Disabled grsecurity.socket_server: Disabled grsecurity.socket_server_gid: Disabled grsecurity.symlinkown_gid: Disabled grsecurity.timechange_logging: Disabled grsecurity.harden_tty: Disabled grsecurity.tpe: Disabled grsecurity.tpe_gid: Disabled grsecurity.tpe_invert: Disabled grsecurity.tpe_restrict_all: Disabled
evilaliv3
Description
I'm not sure if there's a dedicated repository for the kernel used on the SecureDrop servers anymore, so let me know where to put this. But this is a continuation of some prior updates I recommended to the configuration you're using to build. Thanks to a new tool from @a13xp0p0v called kconfig-hardened-check, we no longer have to manually watch changelogs, etc. for when security features and new config flags land in mainline (for those who are unaware, the KSPP has been porting a lot of grsecurity/PaX-inspired features into Linux proper). A brief chat I had with Spender a long time ago confirmed that these generally don't conflict or interfere with grsec.
As this article by @nettrino describes, Linux distributions are hit and miss and many are not taking advantage of the features.
The first obstacle is that you're still on 4.4, so that will narrow the modifications we can make to the config since much of this work landed with 4.14. We'd have to figure out which are available, which are too new, and perform enough testing and quality assurance of the new kernel.
In any event, as a launching-off point, I'm pasting the output of the kconfig-hardened-check script against the current SecureDrop kernel config.