4 ms·

> What do I have to add to my kernel command line? Paranoid users of Ubuntu and Debian can install this package: https://packages.debian.org/bullseye/hardening

> What do I have to add to my kernel command line? Paranoid users of Ubuntu and Debian can install this package: https://packages.debian.org/bullseye/hardening-runtime https://packages.debian.org/bullseye/hardening-runtime . Then reboot. It disables SMT, so independently of mitigations you won’t be vulnerable, but of course Hyper-Threading will be gone.

Abishek_Muthian 6y ago
That is besides processor's microcode mitigations right? Which can be applied using respective ucode packages and grub on Linux.
- tgragnato 6y ago
  You can do it while using microcode patches and software mitigations or not: it’s a hardening measure because SMT usually shares TLBs and L1s between threads. No SMT, no sharing of TLBs and L1s (I know that writing it this way is a gross oversimplification).
hansendc 6y ago
While I'm sure there are folks that would appreciate the mitigation provided by that package, I'm not sure it provides any mitigation to this _specific_ exploit. The in-kernel Spectre-v1 mitigations, like: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c7f631cb07e7da06ac1d231ca178452339e32a94 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... are cheap and ubiquitous. You don't have to turn them on, and they're so cheap you can't even turn them off if you wanted. Disclaimer: I work on Linux at Intel.
eMGm4D0zgUAVXc7 6y ago
Thanks! I'd favor the kernel command line path over using a package, any ideas on which are needed to fix this particular exploit kit at hand?
- pabs3 6y ago
  hardening-runtime modifies the Linux kernel command line (as well as the sysctl config), hence the need to reboot.
SubzeroCarnage 6y ago
I have a much more up-to-date and comprehensive GPL-3.0 package called 'brace' available here: https://github.com/divestedcg/brace https://github.com/divestedcg/brace Supports Fedora, Arch, Debian, and openSUSE. Has GNOME, Firefox, kernel cmdline, sysctl, firewalld, NetworkManager, and systemd unit hardening among other things. Goes well with firejail (am a developer of): https://github.com/netblue30/firejail https://github.com/netblue30/firejail

Abishek_Muthian 6y ago

That is besides processor's microcode mitigations right? Which can be applied using respective ucode packages and grub on Linux.

tgragnato 6y ago
You can do it while using microcode patches and software mitigations or not: it’s a hardening measure because SMT usually shares TLBs and L1s between threads. No SMT, no sharing of TLBs and L1s (I know that writing it this way is a gross oversimplification).

hansendc 6y ago

While I'm sure there are folks that would appreciate the mitigation provided by that package, I'm not sure it provides any mitigation to this _specific_ exploit. The in-kernel Spectre-v1 mitigations, like: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c7f631cb07e7da06ac1d231ca178452339e32a94 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... are cheap and ubiquitous. You don't have to turn them on, and they're so cheap you can't even turn them off if you wanted. Disclaimer: I work on Linux at Intel.

eMGm4D0zgUAVXc7 6y ago

Thanks! I'd favor the kernel command line path over using a package, any ideas on which are needed to fix this particular exploit kit at hand?

pabs3 6y ago
hardening-runtime modifies the Linux kernel command line (as well as the sysctl config), hence the need to reboot.

SubzeroCarnage 6y ago

I have a much more up-to-date and comprehensive GPL-3.0 package called 'brace' available here: https://github.com/divestedcg/brace https://github.com/divestedcg/brace Supports Fedora, Arch, Debian, and openSUSE. Has GNOME, Firefox, kernel cmdline, sysctl, firewalld, NetworkManager, and systemd unit hardening among other things. Goes well with firejail (am a developer of): https://github.com/netblue30/firejail https://github.com/netblue30/firejail