Increased kernel hardening at boot

[raja-grewal]

Please refer to the existing discussion beginning at:
https://forums.whonix.org/t/kernel-hardening/7296/465

In summary:

• Include mitigations by default against 2 additional known hardware-level CPU vulnerabilities (L1D Flushing and MMIO Stale Data).
• Force the kernel to panic on "oopses"
• Enforce IOMMU TLB invalidation
• Distrust the bootloader as source of entropy
• Enables randomisation of the kernel stack offset on syscall entries
• Disables slub_debug due to kernel deciding to implicitly disable kernel pointer hashing
• Explicitly highlight a few existing sysctl defaults

[adrelanos]

Isn't this already implemented?
See:
/usr/libexec/security-misc/panic-on-oops

[raja-grewal]

True I am considering removing the existing implementation as I believe setting it the beginning of the boot process may be more secure?

This way we do not have to rely on the configuration files being read by a user space service.

https://github.com/torvalds/linux/blob/97e9c8eb4bb1dc57859acb1338dfddbd967d7484/Documentation/admin-guide/kernel-parameters.txt#L5681-L5688
https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl

[adrelanos]

I think there was a specific reason why it's done as currently implemented and not as kernel command line. That's a while ago since I last re-read this discussion:
https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713

Could you have a look please?