Hardened Kernel Config File for Virtual Machines (VMs) ("cloud kernel")

[adrelanos]

A kernel config specialized for better security inside virtual machines is in development.

The development preview version can be found here:
https://github.com/Whonix/hardened-kernel/blob/master/usr/share/hardened-kernel/hardened-vm-kernel

This work is being done by @madaidan who also contributed pull requests to linux-hardened.

https://github.com/anthraxx/linux-hardened/pulls?utf8=%E2%9C%93&q=author%3Amadaidan

Discussions about the kernel config happen mostly in Whonix forums.

https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/214

The hardened kernel config was contributed by @madaidan to the @Whonix project but as the maintainer of Whonix I think that it is not the most suitable project to maintain a kernel config. It would be more impactful and would get more eyes on it if it was hosted here.

Therefore I am wondering if there is any chance you would accept a pull request for a hardened (VM) config file? Which folder would be suitable for such a config file?

@madaidan is also working on a hardened bare metal (i.e. non-VM) kernel config:
https://github.com/Whonix/hardened-kernel/blob/master/usr/share/hardened-kernel/hardened-host-kernel

[a13xp0p0v]

Hello @adrelanos,
I guess Whonix has a default and hardened config, am I right?
Is the difference between them documented anywhere?
We can take Whonix official configs to the config_files/distros/.
That's useful for a brief comparison of kernel hardening adoption by various Linux distributions.
There is also the config_files/links.txt file that describes how to get official configs from various distros.
Thanks!

[madaidan]

The current Whonix default is the Debian default. It will be changed to the config mentioned in the post once it's finished.

[a13xp0p0v]

Ok.
So when it is finished, you are welcome to send me the pull request that

• adds the official Whonix hardened config to config_files/distros/;
• adds the corresponding info to config_files/links.txt.

[tsautereau-anssi]

@madaidan After reading your post on the linux-hardened repository, it seems you might be interested in contributing some of your changes to the CLIP OS kernel (see our current configuration here). If so, don't hesitate to open an issue, it would be much appreciated!

Thanks @msalaun-anssi for the heads-up ;)

[adrelanos]

Created clipos/bugs#38 for it.

[madaidan]

@madaidan After reading your post on the linux-hardened repository, it seems you might be interested in contributing some of your changes to the CLIP OS kernel (see our current configuration here). If so, don't hesitate to open an issue, it would be much appreciated!

Sounds great. I'll see what I can do.