1

I am working on prototyping a product using 3.18 Linux kernel.

I am trying to understand the ways to harden Linux Kernel? I am referring a documentation. The document refers to numerous configuration options that should be taken care of? Is that all to hardening the Kernel? Or are there other things that I should take care.

P.S: I cannot move to a newer kernel version as the SoC is supported best on 3.18. I am using gcc-4.9 as the toolchain to build all the software.

6
  • I would believe you could move to some newer kernel version, but that would take some work from your part (perhaps just recompiling the kernel, maybe patching it). And you could use a newer GCC on it (perhaps by recompiling the compiler and binutils) Jul 3 '17 at 5:48
  • @BasileStarynkevitch, if I move to a later kernel and GCC will that help me to achieve better hardening compared to the 3.18/gcc-4.9 combination?
    – sob
    Jul 3 '17 at 6:03
  • 1
    I guess that yes, since the kernel did improve since 3.18 Jul 3 '17 at 6:11
  • Don't you want the grsecurity.net patch ? Jul 3 '17 at 7:31
  • @daftaupe, grsecurity is new for me, thanks for pointing, i will read about it.
    – sob
    Jul 3 '17 at 7:52
5

There exists the GrSecurity patchset, you can find the 3.18 kernel version patches here: http://deb.digdeo.fr/grsecurity-archives/kernel-3.18/

Gentoo has a good page on setting of GrSecurity patches here: https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart you must patch the kernel and the compile with certain config options. GrSecurity offers the highest security you can get regarding Linux.

Recently they have taken the stable patches off of their site, due to various political reasons, but they are still availible in the link above, or if you pay for it. Though obviously the patches are GPL'd.

You can also look into SELinux, some info on the Gentoo page here https://wiki.gentoo.org/wiki/Project:SELinux though i'm sure there are many other places to read about it, but the Gentoo pages are often skewed more toward people who are going to be compiling themselves.

2
  • thanks for pointing me to GrSecurity. I am new to GrSecurity, but I am aware of SELinux, do SELinux and GrSecurity complemnt each other and can be used together in a product?
    – sob
    Jul 3 '17 at 7:51
  • I would probably choose one to use depending on what type of security you're going for. GrSecurity is good for hardening the kernel while SELinux is better for preventing applications from having certain privledges and restrict them as such. So the question is what you want. Jul 7 '17 at 9:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.