On 5/18/22 23:15, Hellosway Here via devel wrote: > Add `slab_nomerge init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none ` as default kernel command line arguments. This can help prevent local exploits by making it harder to exploit the kernel. I do not think there will be any breakage, I have been using these for a long time. The performance impact is minimal, a few of these can improve performance. > > This can help increase the security of Fedora, while also not causing any other problems. Many users do not know what kernel command line arguments are, so doing this will help them with the security of their system. This does not address every problem, or even most of them, but every little bit matters. The most important kernel command line changes are going to be those that ensure speculative execution vulnerabilities are properly mitigated, including disabling SMT if necessary. -- Sincerely, Demi Marie Obenour (she/her/hers) _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
