Hardened linux

Todo: Make a pre-compiled linux-hardened kernel available in Alpine Repositories, so could just do apk add linux-hardened, for people who don't want to compile.

Why Linux-Hardened Kernel?

You may want to get a more security focused kernel, custom private syscalls (only if you compile it for yourself and is not publicly shown), apply Grsecurity/KSPP/GrapheneOS kernel hardening suggestions and remove attack surface from the kernel (with the kernel-hardening-checker APK package).

Developing Linux-hardened kernel with hardened patch

Warning: The following wiki guide was made with Alpine Linux Edge version, and with the testing repository in /etc/apk/repositories

Make a custom linux kernel using this guide [1]. Once you have setup the linux kernel from there, in your current directory ($YOUR_WORK_DIR/aports/main/linux-lts), gather linux hardened patches via these two CLI commands (Replace "$VERSION" with the current latest version in the releases):

$ wget https://github.com/anthraxx/linux-hardened/releases/download/v$VERSION-hardened1/linux-hardened-v$VERSION-hardened1.patch 0006-linux-hardened-v$VERSION-hardened1.patch

$ wget https://github.com/anthraxx/linux-hardened/releases/download/v$VERSION-hardened1/linux-hardened-v$VERSION-hardened1.patch.sig 0007-linux-hardened-v$VERSION-hardened1.patch.sig

Note: To not be confused, this wiki will be using x86_64 as the $ARCH. Replace "x86_64" to a different $ARCH if desired.

Note: Also, this wiki will be using 6.11.10 as the $pkgver and 1 as the $pkgrel. Replace both $pkgver and $pkgrel on newer release versions.

Note: This will be compiled through the Alpine Linux Edge version.

In the "APKBUILD" file, change this "source" line to this:

Contents of ./APKBUILD

... source="https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-$_kernver.tar.xz 0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch 0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch 0003-kexec-add-kexec_load_disabled-boot-option.patch 0004-objtool-respect-AWK-setting.patch 0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch 0006-linux-hardened-v6.11.10-hardened1.patch 0007-linux-hardened-v6.11.10-hardened1.patch.sig lts.x86_64.config virt.x86_64.config " ...

In "APKBUILD" file again, change "pkgver" and "pkgrel" to the same as the releases patch file's "$VERSION"

Contents of ./APKBUILD

... pkgver= ... pkgrel= ...

You may change the pkg name's flavor (if you do that, replace all words "lts" with your preferred flavor name (for example "hardened"), and, for example, change the file lts.x86_64.config to hardened.x86_64.config), but for this wiki it'll just be LTS

Contents of ./APKBUILD

... _flavor=lts ...

There is some need to remove "-hardened1" in the patch file (not the sig file):

Contents of ./0006-linux-hardened-v$VERSION-hardened1.patch

... -EXTRAVERSION = +EXTRAVERSION = -hardened1 ...

Warning: You MUST remove the "EXTRAVERSION" naming ("-hardened1") after it, or installing the package "kernel-hooks" would not do anything, as this "EXTRAVERSION" is not necessary. ("kernel-hooks" apk package is necessary to make a secureboot EFISTUB) [2].

Developing Linux-hardened kernel with hardened config

OPTIONAL: Before compiling the kernel, in the Alpine Linux custom kernel guide [1], you must do some kernel module configurations (do this by abuild -rK for a few seconds, then exiting by Ctrl-C, and then go to src/linux-$VERSION/, download this Arch_hardened_x86_64.config:

$ doas apk add zstd tar $ mkdir arch $ cd arch $ wget -O linux-hardened-headers.pkg.tar.zst https://archlinux.org/packages/extra/x86_64/linux-hardened-headers/download/ $ tar -xvf linux-hardened-headers.pkg.tar.zst $ cd .. && cp ./arch/usr/src/linux-hardened/.config ./Arch_hardened_x86_64.config $ mv ./arch ../../

And do make menuconfig, and select "load", and input the downloaded .config file's name: Arch_hardened_x86_64.config, preferably shorten the amount of kernel modules in the .config files where possible, to reduce compilation times. You may use the just-downloaded Arch_hardened_x86_64.config as a base for configuration simplicity sake. (Use the apk package "kernel-hardening-checker" for configuring .config file as securely as possible, as it contains some grsecurity and kspp kernel configuration suggestions and more.)

Warning: The default Arch_hardened_x86_64.config needs some modification, in menuconfig, general setup -> kernel compression mode, set it to GZIP.

Tip: To use kernel-hardening-checker, do mkdir kernel-hardening-checker && cd kernel-hardening-checker, and you should acquire THREE files in the current directory: one with sysctl parameters ($ doas sysctl -a > sysctl.conf"sysctl.conf"), one with boot parameters ($ cat /proc/version > ./cmdline.conf"cmdline.conf"), and the .config file ("Arch_hardened_x86_64.config"). And then run with this CLI command: $ kernel-hardening-checker -c ./Arch_hardened_x86_64.config -s ./sysctl.conf -l ./cmdline.conf

---

Afterwards do cd .. && mv ./kernel-hardening-checker $YOUR_WORK_DIR/aports/main/linux-lts so you dont lose this directory when it finishes compiling the kernel (it deletes the src directory).

Note: Continuing from the above OPTIONAL paragraph, do cp $YOUR_WORK_DIR/aports/main/linux-lts/src/linux-$VERSION/Arch_hardened_x86_64.config $YOUR_WORK_DIR/aports/main/linux-lts/lts.x86_64.config when finished configuring .config kernel file.

Note: $YOUR_WORK_DIR/aports/main/linux-lts/virt.x86_64.config is the kernel for virtualization (QEMU, Xen), do not customize this for this wiki.

After applying this, you may do cd $YOUR_WORK_DIR/aports/main/linux-lts and abuild checksum && abuild -r to start compiling the kernel.

When the compile has successfully completed, you should see ~/packages/main/$ARCH/linux-lts-$VERSION.apk and may install by apk add linux-lts=$VERSION(make sure to do apk update, and that /etc/apk/repositories contains $YOUR_USERS_HOME_DIR/packages/main.

External Links:

Custom Kernel (AlpineWiki):

• Custom_Kernel [1]

EFIStub (Secure Boot) (AlpineWiki):

• UEFI_Secure_Boot [2]

Releases page:

• https://github.com/anthraxx/linux-hardened/releases [3]

Some resources for help creating this page:

• https://strfry.github.io/blog/building-alpine-kernel.html [4]

Arch Linux linux-hardened package repo (to decompress and aquire its .config)

• https://archlinux.org/packages/?sort=&q=hardened&packager=anthraxx&flagged= [5]