* Self introduction
@ 2021-09-19 20:44 Tad
0 siblings, 0 replies; only message in thread
From: Tad @ 2021-09-19 20:44 UTC (permalink / raw)
To: kernel-hardening; +Cc: linux-hardening
My name is Tad.
I have a few personal projects for the past five or so years for making
available kernel hardening features to more users.
My main project is DivestOS, which provides more secure images for older/legacy
I harden all device kernels via the following:
* My automatic CVE checker/patcher program . It is able to apply many dozen
to many hundred CVE patches to trees. It is backed by an extensive versioned
list  of CVE patches that I origianlly maintained by hand. In the past
year or so I pull in using a scraper I made for the CIP scripts .
* My hardenDefconfig function , inspired by the KSPP recommendations and
later Popov's kconfig-hardened-check. It simply enables and disables various
* My hardenBootArgs function , currently just enables slub_debug=FZP for
* Some misc tweaks , currently for disabling slub/slab merging.
* And lastly some sysctl tweaks .
I also maintain another project for providing some extra security to modern
distros, without recompilation.
It is called Brace  and compatible with Arch/Fedora/Debian/OpenSUSE.
In the kernel relations, it is mostly just sysctl  changes and kernel
commandline  changes.
Lastly some background:
Micay inspired me to work on this area back in mid-2015, after he helped me port
his Android PaX patchset to the OnePlus One phone .
Sharing for any comments.
Also most of you are likely working on mainline, not ancient kernels, so maybe
you'll find this interesting.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-09-19 20:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-19 20:44 Self introduction Tad
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).