Hardened linux

Developing linux-kernel with hardened patch

Make a custom linux kernel using this guide [1]. Once you have setup the linux kernel from there, in your current directory ($YOUR_WORK_DIR/aports/main/linux-lts), gather linux hardened patches via these two CLI commands (Replace "$VERSION" with the current latest version in the releases):

$ wget https://github.com/anthraxx/linux-hardened/releases/download/v$VERSION-hardened1/linux-hardened-v$VERSION-hardened1.patch 0006-linux-hardened-v$VERSION-hardened1.patch

$ wget https://github.com/anthraxx/linux-hardened/releases/download/v$VERSION-hardened1/linux-hardened-v$VERSION-hardened1.patch.sig 0007-linux-hardened-v$VERSION-hardened1.patch.sig

Note: To not be confused, this wiki will be using x86_64 as the $ARCH. Replace "x86_64" to a different $ARCH if desired.

In the "APKBUILD" file, change this "source" line to this:

Contents of ./APKBUILD

...
source="https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-$_kernver.tar.xz
    0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
    0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
    0003-kexec-add-kexec_load_disabled-boot-option.patch
    0004-objtool-respect-AWK-setting.patch
    0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch

    0006-linux-hardened-v6.11.10-hardened1.patch
    0007-linux-hardened-v6.11.10-hardened1.patch.sig

    lts.x86_64.config

    virt.x86_64.config
    "
...

In "APKBUILD" file again, change "pkgver" and "pkgrel" to the same as the releases patch file's "$VERSION"

Contents of ./APKBUILD

...
pkgver=
...
pkgrel=
...

You may change the pkg name's flavor (if you do that, replace all words "lts" with your preferred flavor name), but for this wiki it'll just be LTS

Contents of ./APKBUILD

...
_flavor=lts
...

There is some need to remove "-hardened1" in the patch file (not the sig file):

Contents of ./0006-linux-hardened-v$VERSION-hardened1.patch

...
 -EXTRAVERSION =
 +EXTRAVERSION = -hardened1
...

You MUST remove the "EXTRAVERSION" naming ("-hardened1") after it, or installing the package "kernel-hooks" would not do anything, as this "EXTRAVERSION" is not necessary. ("kernel-hooks" apk package is necessary to make a secureboot EFISTUB) [2].

OPTIONAL: Before compiling the kernel, in the Alpine Linux custom kernel guide [1], you must do some kernel module configurations (do this by abuild -rK for a few seconds, then exiting by Ctrl-C, and then go to src/linux-$VERSION/, wget [this linux-hardened KCONFIG] [5], and do make menuconfig, and select "load kernel", and input the wget'd KCONFIG file's name.), preferably shorten the amount of kernel modules in the KCONFIG files where possible, to reduce compilation times. You may borrow [this linux-hardened KCONFIG] [5] from the package "kernel-hardening-checker's" repo as a base, for configuration simplicity sake. (Use the apk package "kernel-hardening-checker" for configuring KCONFIG file as securely as possible, as it contains some grsecurity and kspp kernel configuration suggestions and more.)

Note: Continuing from the above OPTIONAL paragraph, do

cp $YOUR_WORK_DIR/aports/main/linux-lts/src/linux-$VERSION/Arch_hardened_x86_64.config $YOUR_WORK_DIR/aports/main/linux-lts/lts.x86_64.config

(and $YOUR_WORK_DIR/aports/main/linux-lts/virt.x86_64.config if you want to also modify virt.x86_64.config) when finished configuring KCONFIG kernel file.

After applying this, you may do cd $YOUR_WORK_DIR/aports/main/linux-lts and abuild checksum && abuild -r to start compiling the kernel.

When the compile has successfully completed, you should see ~/packages/main/$ARCH/linux-lts-$VERSION.apk and may install by apk add linux-lts=$VERSION(make sure to do apk update, and that /etc/apk/repositories contains $YOUR_USERS_HOME_DIR/packages/main.

External Links:

Developing linux-kernel with hardened patch

External Links:

Custom Kernel (AlpineWiki):

EFIStub (Secure Boot) (AlpineWiki):

Releases page:

Some resources for help creating this page:

Linux-Hardened KCONFIG file