Hardened linux: Difference between revisions

Revision as of 18:39, 10 December 2024

Todo: Soon will provide Alpine Linux Edge - Testing Repo a Linux-Hardened APK package, to avoid compiling your own! WORK-IN-PROGRESS REPO: https://gitlab.alpinelinux.org/Pursuable1652/linux-hardened (compiling error with latest 6.11.11-r1 archlinux-hardened kconfig?)

Why Linux-Hardened Kernel?

You may want to get a more security focused kernel, custom private syscalls (only if you compile it for yourself and is not publicly shown), apply Grsecurity/KSPP/GrapheneOS kernel hardening suggestions and remove attack surface from the kernel (with the kernel-hardening-checker APK package).

Developing linux-kernel with hardened patch

Warning: The following wiki guide was made with Alpine Linux Edge version, and with the testing repository in /etc/apk/repositories

Make a custom linux kernel using this guide [1]. Once you have setup the linux kernel from there, in your current directory ($YOUR_WORK_DIR/aports/main/linux-lts), gather linux hardened patches via these two CLI commands (Replace "$VERSION" with the current latest version in the releases):

$ wget https://github.com/anthraxx/linux-hardened/releases/download/v$VERSION-hardened1/linux-hardened-v$VERSION-hardened1.patch 0006-linux-hardened-v$VERSION-hardened1.patch

$ wget https://github.com/anthraxx/linux-hardened/releases/download/v$VERSION-hardened1/linux-hardened-v$VERSION-hardened1.patch.sig 0007-linux-hardened-v$VERSION-hardened1.patch.sig

Note: To not be confused, this wiki will be using x86_64 as the $ARCH. Replace "x86_64" to a different $ARCH if desired.

Note: Also, this wiki will be using 6.11.10 as the $pkgver and 1 as the $pkgrel. Replace both $pkgver and $pkgrel on newer release versions.

Note: This will be compiled through the Alpine Linux Edge version.

In the "APKBUILD" file, change this "source" line to this:

Contents of ./APKBUILD

...
source="https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-$_kernver.tar.xz
    0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
    0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
    0003-kexec-add-kexec_load_disabled-boot-option.patch
    0004-objtool-respect-AWK-setting.patch
    0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch

    0006-linux-hardened-v6.11.10-hardened1.patch
    0007-linux-hardened-v6.11.10-hardened1.patch.sig

    lts.x86_64.config

    virt.x86_64.config
    "
...

In "APKBUILD" file again, change "pkgver" and "pkgrel" to the same as the releases patch file's "$VERSION"

Contents of ./APKBUILD

...
pkgver=
...
pkgrel=
...

You may change the pkg name's flavor (if you do that, replace all words "lts" with your preferred flavor name), but for this wiki it'll just be LTS

Contents of ./APKBUILD

...
_flavor=lts
...

There is some need to remove "-hardened1" in the patch file (not the sig file):

Contents of ./0006-linux-hardened-v$VERSION-hardened1.patch

...
 -EXTRAVERSION =
 +EXTRAVERSION = -hardened1
...

Warning: You MUST remove the "EXTRAVERSION" naming ("-hardened1") after it, or installing the package "kernel-hooks" would not do anything, as this "EXTRAVERSION" is not necessary. ("kernel-hooks" apk package is necessary to make a secureboot EFISTUB) [2].

Linux-hardened kernel configuration

OPTIONAL: Before compiling the kernel, in the Alpine Linux custom kernel guide [1], you must do some kernel module configurations (do this by abuild -rK for a few seconds, then exiting by Ctrl-C, and then go to src/linux-$VERSION/, download this linux-hardened KCONFIG:

apk add zstd mkdir arch cd arch wget -O linux-hardened-headers.pkg.tar.zst https://archlinux.org/packages/extra/x86_64/linux-hardened-headers/download/ tar -xvf linux-hardened-headers.pkg.tar.zst cd .. && cp ./arch/usr/src/linux-hardened/.config ./Arch_hardened_x86_64.config mv ./arch ../../

And do make menuconfig, and select "load", and input the downloaded KCONFIG file's name: Arch_hardened_x86_64.config.), preferably shorten the amount of kernel modules in the KCONFIG files where possible, to reduce compilation times. You may use the just-downloaded Arch Linux hardened KCONFIG for configuration simplicity sake. (Use the apk package "kernel-hardening-checker" for configuring KCONFIG file as securely as possible, as it contains some grsecurity and kspp kernel configuration suggestions and more.)

Tip: To use kernel-hardening-checker, do mkdir kernel-hardening-checker && cd kernel-hardening-checker, and you should acquire THREE files in the current directory: one with sysctl parameters ($ doas sysctl -a > sysctl.conf"sysctl.conf"), one with boot parameters ($ cat /proc/version > ./cmdline"cmdline"), and the KCONFIG file ("Arch_hardened_x86_64.config"). And then run with this CLI command: $ kernel-hardening-checker -c ./Arch_hardened_x86_64.config -s ./sysctl.conf -l ./secureboot.conf

Afterwards do cd .. && mv ./kernel-hardening-checker $YOUR_WORK_DIR/aports/main/linux-lts so you dont lose this directory when it finishes compiling the kernel (it deletes the src directory).

Note: Continuing from the above OPTIONAL paragraph, do

cp $YOUR_WORK_DIR/aports/main/linux-lts/src/linux-$VERSION/Arch_hardened_x86_64.config $YOUR_WORK_DIR/aports/main/linux-lts/lts.x86_64.config

when finished configuring KCONFIG kernel file.

Note: $YOUR_WORK_DIR/aports/main/linux-lts/virt.x86_64.config is the kernel for virtualization (QEMU, Boxes, VirtualBox, Xen), do not customize this for this wiki.

After applying this, you may do cd $YOUR_WORK_DIR/aports/main/linux-lts and abuild checksum && abuild -r to start compiling the kernel.

When the compile has successfully completed, you should see ~/packages/main/$ARCH/linux-lts-$VERSION.apk and may install by apk add linux-lts=$VERSION(make sure to do apk update, and that /etc/apk/repositories contains $YOUR_USERS_HOME_DIR/packages/main.

External Links:

@@ Line 61: / Line 61: @@
 ==== Linux-hardened kernel configuration ====
-OPTIONAL: Before compiling the kernel, in [[Custom_Kernel|the Alpine Linux custom kernel guide]] [1], you must do some kernel module configurations (do this by <code>abuild -rK</code> for a few seconds, then exiting by Ctrl-C, and then go to <code>src/linux-$VERSION/</code>, download [[https://github.com/a13xp0p0v/kernel-hardening-checker/blob/master/kernel_hardening_checker/config_files/distros/Arch_hardened_x86_64.config this linux-hardened KCONFIG]] [5], and do <code>make menuconfig</code>, and select "load", and input the downloaded KCONFIG file's name.), preferably shorten the amount of kernel modules in the KCONFIG files where possible, to reduce compilation times. You may borrow [[https://github.com/a13xp0p0v/kernel-hardening-checker/blob/master/kernel_hardening_checker/config_files/distros/Arch_hardened_x86_64.config this linux-hardened KCONFIG]] [5] from the package "<code>kernel-hardening-checker</code>'s" repo as a base, for configuration simplicity sake. (Use the apk package "<code>kernel-hardening-checker</code>" for configuring KCONFIG file as securely as possible, as it contains some grsecurity and kspp kernel configuration suggestions and more.)
+OPTIONAL: Before compiling the kernel, in [[Custom_Kernel|the Alpine Linux custom kernel guide]] [1], you must do some kernel module configurations (do this by <code>abuild -rK</code> for a few seconds, then exiting by Ctrl-C, and then go to <code>src/linux-$VERSION/</code>, download this linux-hardened KCONFIG:
+{{cmd| apk add zstd
-{{Tip| For a more up-to-date kernel, or just download the hardened arch kernel source, you could use this command to get from Arch Repo (must use gnu wget and zstd - <code>apk add wget zstd</code>) (You CANNOT use this kernel with <code>kernel-hooks</code> as it has "EXTRAVERSION" in the patch of this precompiled kernel, so must compile your own linux-hardened if using <code>kernel-hooks</code>):
+mkdir arch
-{{cmd|mkdir arch
 cd arch
 wget -O linux-hardened-headers.pkg.tar.zst https://archlinux.org/packages/extra/x86_64/linux-hardened-headers/download/
-tar -xvf linux-hardened-headers.pkg.tar.zst}}
+tar -xvf linux-hardened-headers.pkg.tar.zst
-----
+cd .. && cp ./arch/usr/src/linux-hardened/.config ./Arch_hardened_x86_64.config
-After, do <code>cd .. && cp ./arch/usr/src/linux-hardened/.config ./Arch_hardened_x86_64.config</code>
+mv ./arch ../../
 }}
+And do <code>make menuconfig</code>, and select "load", and input the downloaded KCONFIG file's name: <code>Arch_hardened_x86_64.config</code>.), preferably shorten the amount of kernel modules in the KCONFIG files where possible, to reduce compilation times. You may use the just-downloaded Arch Linux hardened KCONFIG for configuration simplicity sake. (Use the apk package "<code>kernel-hardening-checker</code>" for configuring KCONFIG file as securely as possible, as it contains some grsecurity and kspp kernel configuration suggestions and more.)
 {{Tip| To use <code>kernel-hardening-checker</code>, do <code>mkdir kernel-hardening-checker && cd kernel-hardening-checker</code>, and you should acquire THREE files in the current directory: one with sysctl parameters (<code>$ doas sysctl -a > sysctl.conf</code>"sysctl.conf"), one with boot parameters (<code>$ cat /proc/version > ./cmdline</code>"cmdline"), and the KCONFIG file ("Arch_hardened_x86_64.config"). And then run with this CLI command: <code>$ kernel-hardening-checker -c ./Arch_hardened_x86_64.config -s ./sysctl.conf -l ./secureboot.conf</code>

Revision as of 18:39, 10 December 2024

Why Linux-Hardened Kernel?

Developing linux-kernel with hardened patch

Linux-hardened kernel configuration

External Links:

Custom Kernel (AlpineWiki):

EFIStub (Secure Boot) (AlpineWiki):

Releases page:

Some resources for help creating this page:

Linux-Hardened KCONFIG file

Arch Linux linux-hardened package repo