Hardening checklist, take 2

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

Had lots of problems the first time around, so started over with a VM and hardened toolchain. gradm is installed, but not enabled (which is what I'm planning to do next unless I've missed something).

I've emerged a few things since switching to the kernel with grsec & pax enabled, so I think that works at least at a basic level. Is there anything below I need to correct first? Anything else before moving on to gradm? Thx.

Should I fix something for ET_EXEC and memcpy?

Sadako · Posted: Sat Nov 13, 2010 3:49 pm Post subject:

You're paxtest results are more or less identical to mine, and everyone else's I've seen.

From what I know, ET_EXEC is only relevant to non-pie binaries, which should be a very small minority on a gentoo system with a hardened toolchain, you can use scanelf to see if a particular executable is affected (eg `scanelf -a /usr/bin/*`), should be either ET_DYN or ET_EXEC.

Not too sure on why the memcpy tests always return "vulnerable", but it's the normal result from what I've seen.

I've never seen a recommendation for enabling "GCC stack protector support" from the hardened or grsec people, and it has been known to cause some issues (maybe incompatible with pax?), so I've never played with it, and it's still marked experimental anyways.

"Strict user copy checks" is a compile-time only thing, so enabling it shouldn't have any affect on a running kernel, it'll just cause a compile failure if a problem is found.

Dunno about "Enforce read-only kernel data", can't find any reference to it...

Should be safe (and a good idea) to restrict/disable both mem and kmem under /dev, ie "CONFIG_DEVKMEM" should be disabled and "CONFIG_STRICT_DEVMEM" enabled.
May cause issues with some software depending on what you need but I've had no issues.
On the other hand, if you need either enabled "CONFIG_GRKERNSEC_KMEM" offers more or less the same protection anyways.

"Prevent userspace pointer deref", ie uderef, for a 64-bit kernel you should probably read this.
For what it's worth, I have it enabled on a 64-bit host with no noticeable issues, I don't think virtualbox works with it (and probably some other virtual machines), but anything using kvm whould work just fine under a fully hardened host.

Never came across KERNHEAP before, I'd love to know what it offers that pax doesn't, pity the only patches that seem to be available are for 2.6.33...

HTH.
_________________
"You have to invite me in"

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

Thanks. I guess that mostly means everything is more or less OK. I'm rebuilding the kernel now with the CONFIG_DEVKMEM / CONFIG_STRICT_DEVMEM changes (CONFIG_GRKERNSEC_KMEM was already enabled).

uderef was a little over my head, but I got enough out of it, thanks. I think I'll leave it off for now and do some more research.
_________________
Quis separabit? Quo animo?