Kernel suggestions

[miyashital]

Hi. Thank you very much for the patch and Arch package.

The linux-hardened config uses:

CONFIG_CMDLINE="pti=on page_alloc.shuffle=1"

I would like to propose extending this with the following set of options (including those two):

init_on_alloc=1
init_on_free=1
l1tf=full,force
lockdown=integrity
lsm=lockdown,yama
mds=full,nosmt
nosmt=force
page_alloc.shuffle=1
page_poison=1
pti=on
slab_nomerge
slub_debug=FZP
spec_store_bypass_disable=on
spectre_v2=on
tsx=off
vsyscall=none

A few of these options are redundant with the kernel config, but there's no harm in having them listed here. If anything, it makes the patch easier to understand for non-programmers in my opinion.

Notably, upstream's default for the spec_store_bypass_disable vulnerability is incomplete and unsafe. It needs to be explicitly turned on here. Same with the MDS fix since it requires disabling hyperthreading. Since this is linux-hardened and not linux-quickened, I think security should take priority.

Second, I'm using the following sysctl settings and wanted to suggest any/all of them for inclusion as defaults:

dev.tty.ldisc_autoload=0
fs.protected_fifos=2
fs.protected_hardlinks=1
fs.protected_regular=2
fs.protected_symlinks=1
fs.suid_dumpable=0
kernel.dmesg_restrict=1
kernel.kexec_load_disabled=1
kernel.kptr_restrict=2
kernel.perf_event_paranoid=3
kernel.randomize_va_space=2
kernel.sysrq=0
kernel.tiocsti_restrict=1
kernel.unprivileged_bpf_disabled=1
kernel.unprivileged_userns_clone=0
kernel.yama.ptrace_scope=3
net.core.bpf_jit_harden=2
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.secure_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.all.shared_media=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.default.secure_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.default.shared_media=0
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.ip_forward=0
net.ipv4.tcp_rfc1337=1
net.ipv4.tcp_sack=0
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_timestamps=0
net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.default.accept_redirects=0
vm.mmap_min_addr=65536
vm.mmap_rnd_bits=32
vm.mmap_rnd_compat_bits=16
vm.unprivileged_userfaultfd=0

Some of them like kernel.tiocsti_restrict, kernel.dmesg_restrict, vm.unprivileged_userfaultfd, and so on seem to be compiled in by default with the Arch package's kernel config. I'm not savvy enough to "de-duplicate" the whole list, so I'm including it for completeness' sake.

Alternatively, the linux-hardened package could also include an /etc/sysctl.d/99-linux-hardened.conf file. That would be neat.

Last, a question: I noticed the net.ipv4.tcp_simult_connect sysctl was committed but it doesn't seem to work for me in the latest version.

Thanks for your time.

[madaidan]

init_on_alloc=1
init_on_free=1
page_alloc.shuffle=1
pti=on
slab_nomerge
vsyscall=none

These are all defaults.

lockdown=integrity

Lockdown is not enabled by default for a reason. #14

l1tf=full,force
mds=full,nosmt
nosmt=force
spec_store_bypass_disable=on
spectre_v2=on
tsx=off

Forcing mitigations/SMT disabling would be a massive performance decrease that most linux-hardened users won't like.

page_poison=1
slub_debug=P

Conflicts with init_on_free.

slub_debug=F

This could be useful.

slub_debug=Z

I'm not sure if there's any advantage when used with slab canaries.

dev.tty.ldisc_autoload=0

Would be useful but is better set with CONFIG_LDISC_AUTOLOAD.

fs.protected_fifos=2
fs.protected_hardlinks=1
fs.protected_regular=2
fs.protected_symlinks=1
fs.suid_dumpable=0
kernel.dmesg_restrict=1
kernel.kexec_load_disabled=1
kernel.kptr_restrict=2
kernel.perf_event_paranoid=3
kernel.randomize_va_space=2
kernel.tiocsti_restrict=1
kernel.unprivileged_bpf_disabled=1
kernel.unprivileged_userns_clone=0
net.core.bpf_jit_harden=2
net.ipv4.tcp_syncookies=1
vm.mmap_min_addr=65536
vm.mmap_rnd_bits=32
vm.mmap_rnd_compat_bits=16

All defaults.

kernel.yama.ptrace_scope=3

linux-hardened defaults to 1. 3 is too restrictive to be the default.

net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.secure_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.all.shared_media=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.default.secure_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.default.shared_media=0
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.ip_forward=0
net.ipv4.tcp_rfc1337=1
net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.default.accept_redirects=0

Not completely sure, but likely all defaults.

net.ipv4.tcp_sack=0

This can have a large performance decrease and isn't suitable as a default.

net.ipv4.tcp_timestamps=0

Can be useful for anonymity purposes but not security.

vm.unprivileged_userfaultfd=0

Userfaultfd isn't even enabled in the kernel config and if it is, this is a default.

So, to summarize, the only really useful ones are slub_debug=F and dev.tty.ldisc_autoload=0. Maybe the CPU stuff if anthraxx decides the performance loss is worth it.

Last, a question: I noticed the net.ipv4.tcp_simult_connect sysctl was committed but it doesn't seem to work for me in the latest version.

You need to wait for the package to catch up with git.

[miyashital]

Thanks for your breakdown of which ones are enabled by default. I'll update my local notes about those.

Not completely sure, but likely all defaults.

Might be worth someone more familiar with the patch to double-check those.

Forcing mitigations/SMT disabling would be a massive performance decrease that most linux-hardened users won't like.

This can have a large performance decrease and isn't suitable as a default.

I have to say I completely disagree on these, though. This is linux-hardened, not linux-quickened. Security should absolutely be the priority, even at the cost of some performance. Users who opt in to using this patchset obviously care about security.

[madaidan]

I have to say I completely disagree on these, though. This is linux-hardened, not linux-quickened. Security should absolutely be the priority, even at the cost of some performance. Users who opt in to using this patchset obviously care about security.

These have the potential to slow performance down to a crawl. It's not just a minor performance decrease.

[anthraxx]

We also already set some of those sysctl things by default so at least take the time when suggesting something to investigate what really is the request for change.

You also can't use vanilla page poisoning as that collides with the page verify code of hardened, please don't suggest things that are destructive when enabling PAGE_POISONING etc.

Thanks for trying to improve something but this is not the Arch package bug tracker, this is plainly the upstream hardened kernel source and the CMDLINE is not even set here. I don't think its very productive to try to suggest and discuss quadrillion of things in a single topic.

[anthraxx]

closing due no response. Please feel free to suggest concrete changes after looking into the defaults.