On 5/23/22 14:50, Steve Grubb wrote: > Hello, > > On Wednesday, May 18, 2022 11:15:16 PM EDT Hellosway Here via devel wrote: >> Add `slab_nomerge init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 >> pti=on randomize_kstack_offset=on vsyscall=none ` as default kernel >> command line arguments. This can help prevent local exploits by making it >> harder to exploit the kernel. I do not think there will be any breakage, I >> have been using these for a long time. The performance impact is minimal, >> a few of these can improve performance. > > I spent quite some time studying these to make some recommendations for the > RHEL 9 SCAP Security Guide. The init_on_free is not cacheline friendly. It > will impact performance. But I have to ask, since the SCAP Security Guide + > openscap can manage the kernel settings, do we need to turn them on by > default? And wouldn't you want to have certain sysctls also set? For example, > you might want to turn off user name spaces. I honestly have no idea how to use openscap, and my attempts to use it did not go very well. I would much rather have the system be secure by default. > The problem is that there really isn't a one size fits all. Turning off user > namespaces will make some people unhappy. Turning off vsyscalls will make > some people unhappy. Because these all are configurable, should this be part > of an overall security hardening plan? And managed by a tool that can check > that everything is still how you think it should be? And maybe with a GUI > tool that let's you tailor the policy to your needs? A GUI tool would be great. -- Sincerely, Demi Marie Obenour (she/her/hers) _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
