What is linux-hardened and how is it different from the basic linux kernel?

Octopus1348@lemy.lol to Linux@lemmy.ml – 47 points –

I am too lazy to research it and still wondering. Can someone give me a basic explanation of it?

21

You don't mention any specific distro, but I'm guessing it's pretty similar across distros. And since Arch tends to have good documentation, I've focused mostly on Arch. (I use Arch BTW. Fight me. :wink:)

The differences are that a different set of configuration options were selected when building the Kernel. All differences in configuration were selected with security in mind.

Here is a full list with lots of details but just vaguely (in roughly the same order as they are on the Arch page):

  • It takes some special memory management steps to mitigate buffer overflow and stack overflow kind of vulnerabilities that might exist in other programs on the system.
  • It locks down access to some information about specific kernel processes to prevent malicious programs from accessing those kernel processes. (And the wiki page says specifically that this doesn't really help much unless you compile your own kernel, but yeah.)
  • Locks down "BPF" which, honestly, I don't know much about. Has something to do with firewalls?
  • Prevents one application from getting internal data about another application (like happens with programs like strace or gdb.)
  • Hides other users' processes from your current user.
  • Prevents loading of unsigned kernel modules.
  • Turns off a feature that lets you replace a running kernel with a newer kernel version without restarting the whole computer.
  • Enables "Kernel lockdown mode" which "strengthens the boundary between what the root user can access and kernel space.
  • Enables "LKRG" which is kindof an "intrusion detection system for the Linux kernel."
  • Disables the emergency shell that can otherwise be used to debug and recover when your system fails to boot. (But could also be used to do evil things if an adversary has physical access to the computer, I think?)

So, all fairly technical stuff, but just locks stuff down and locks down things to improve overall security at the expense of some functionality. Some applications just straight won't work with a hardened kernel. (skypeforlinux-stable-bin is an example of a program that the Arch page listed above gives that just won't work.)

I'm running self compiled hardened kernel and I enabled kernel lockdown mode. Before that it was disabled. Maybe Arch team disabled it.

1 more...

It just has security checks and randomization that makes it harder to compromise. The trade off is usually performance.

The Linux kernel varies between mainstream distros. For instance, I believe that Fedora goes for a more hardened configuration while Debian targets stability

If you want to learn more with some hands one experience try Gentoo

My question would be "how do hardening kargs differ from a hardened kernel"?

Kargs can be dynamically applied and work easily on immutable distros. Tbh a monolithic unhardened kernel is my biggest problem with immutable Distros, as changing that is quite drastic.

I don't think that project is maintained anymore, but at one point in time it used to add patches that were part of the Kernel Self Protection project. I believe those changes are now largely part of the mainline kernel.

I.e. it's not different anymore.

EDIT: Looks like it's still maintained.

I am too lazy to research it and still wondering.

The arch wiki wrote about linux-hardened. You can repeat what they say like a machine.

You cannot trust us doing researches for you.

i like to see questions like this when it's something i've never heard about (new to linux), and then come and read an eli5. it's an easy way for us noobs to collect information and there are always people who enjoy explaining this stuff.

Their words shows that they purely depend on people to quote information for them and they are not going to do researches.