Linux Kernel Hardening: Modern Security Features and Mitigation Techniques#

1
/* Example: Vulnerable kernel code patterns */
2

3
// 1. Buffer overflow vulnerability
4
static long vulnerable_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
5
{
6
    char buffer[64];
7

8
    // Vulnerable: No bounds checking
9
    if (copy_from_user(buffer, (void __user *)arg, 128))
10
        return -EFAULT;
11

12
    return 0;
13
}
14

15
// 2. Use-after-free vulnerability
16
struct my_data {
17
    void (*callback)(void);
18
    char data[100];
19
};
20

21
static void vulnerable_free(struct my_data *data)
22
{
23
    kfree(data);
24
    // Vulnerable: Use after free
25
    data->callback();
26
}
27

28
// 3. Race condition vulnerability
29
static int vulnerable_open(struct inode *inode, struct file *file)
30
{
31
    // Vulnerable: TOCTOU race condition
32
    if (!capable(CAP_SYS_ADMIN))
33
        return -EPERM;
34

35
    // Time window for privilege change
36
    msleep(10);
37

38
    // Assumes capability still valid
39
    file->private_data = sensitive_data;
40
    return 0;
41
}

1
// Page Table Entry inversion for L1TF
2
static inline void __pte_to_swp_entry_invert(pte_t *pte)
3
{
4
    pte->pte = pte_val(*pte) ^ _PAGE_PROTNONE;
5
}
6

7
// L1D cache flush on VM entry
8
static void l1d_flush(void)
9
{
10
    int size = PAGE_SIZE << L1D_CACHE_ORDER;
11
    void *buffer = this_cpu_ptr(&l1d_flush_pages);
12

13
    /* Fill L1D with safe data */
14
    asm volatile(
15
        "xorl   %%eax, %%eax\n"
16
        ".Lfill_cache:\n\t"
17
        "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
18
        "addl   $64, %%eax\n\t"
19
        "cmpl   %%eax, %[size]\n\t"
20
        "jne    .Lfill_cache\n\t"
21
        "lfence\n"
22
        :: [flush_pages] "r" (buffer),
23
           [size] "r" (size)
24
        : "eax", "ecx", "memory"
25
    );
26
}

1
// CPU buffer clear on context switch
2
static inline void mds_clear_cpu_buffers(void)
3
{
4
    static const u16 ds = __KERNEL_DS;
5

6
    /*
7
     * Clear CPU buffers by performing a dummy verw instruction
8
     * with the kernel data segment
9
     */
10
    asm volatile("verw %[ds]" : : [ds] "m" (ds) : "cc");
11
}
12

13
// Automatic buffer clearing
14
static void mds_user_clear_cpu_buffers(void)
15
{
16
    if (!static_branch_likely(&mds_user_clear))
17
        return;
18

19
    mds_clear_cpu_buffers();
20
}

1
// Enforce W^X protections
2
static int check_wx_pages(void)
3
{
4
    struct page *page;
5
    unsigned long pfn;
6
    int failed = 0;
7

8
    for_each_online_pgdat(pgdat) {
9
        for (pfn = pgdat->node_start_pfn;
10
             pfn < pgdat->node_start_pfn + pgdat->node_spanned_pages;
11
             pfn++) {
12

13
            page = pfn_to_page(pfn);
14

15
            if (!page_is_ram(pfn))
16
                continue;
17

18
            /* Check for W+X mappings */
19
            if (page_is_writable(page) && page_is_executable(page)) {
20
                pr_warn("Found W+X page at 0x%lx\n",
21
                        pfn << PAGE_SHIFT);
22
                failed++;
23
            }
24
        }
25
    }
26

27
    return failed;
28
}
29

30
// Set proper permissions
31
static void set_memory_protection(void *addr, size_t size, pgprot_t prot)
32
{
33
    unsigned long start = (unsigned long)addr;
34
    unsigned long end = start + size;
35

36
    /* Round to page boundaries */
37
    start = round_down(start, PAGE_SIZE);
38
    end = round_up(end, PAGE_SIZE);
39

40
    /* Apply protection */
41
    if (pgprot_val(prot) & _PAGE_NX) {
42
        set_memory_nx(start, (end - start) >> PAGE_SHIFT);
43
    }
44
    if (!(pgprot_val(prot) & _PAGE_RW)) {
45
        set_memory_ro(start, (end - start) >> PAGE_SHIFT);
46
    }
47
}

1
// CONFIG_FORTIFY_SOURCE=y
2

3
// Fortified string operations
4
#define __fortify_memcpy(dest, src, len)                           \
5
({                                                                  \
6
    size_t __len = (len);                                          \
7
    size_t __dest_size = __builtin_object_size(dest, 0);          \
8
    size_t __src_size = __builtin_object_size(src, 0);            \
9
                                                                   \
10
    if (__builtin_constant_p(__len) && __len > __dest_size)       \
11
        __fortify_panic(__func__);                                 \
12
    if (__builtin_constant_p(__len) && __len > __src_size)        \
13
        __fortify_panic(__func__);                                 \
14
                                                                   \
15
    __builtin_memcpy(dest, src, len);                            \
16
})
17

18
// Usage
19
void safe_copy(void *dst, const void *src, size_t len)
20
{
21
    char buffer[64];
22

23
    /* Compile-time check if len > 64 */
24
    __fortify_memcpy(buffer, src, len);
25
}

1
// Kernel stack guard pages
2
static int setup_stack_guard_page(struct task_struct *tsk)
3
{
4
    struct page *page;
5
    unsigned long addr;
6

7
    /* Allocate stack with guard page */
8
    addr = __get_free_pages(GFP_KERNEL, THREAD_SIZE_ORDER);
9
    if (!addr)
10
        return -ENOMEM;
11

12
    /* Set up guard page at bottom of stack */
13
    page = virt_to_page(addr);
14
    set_page_guard(page);
15

16
    /* Mark guard page as non-present */
17
    __set_page_prot(page, __pgprot(0));
18

19
    tsk->stack = (void *)(addr + PAGE_SIZE);
20
    return 0;
21
}

1
#!/bin/bash
2
# kernel-hardening.sh - Apply runtime hardening
3

4
# Kernel parameters
5
cat > /etc/sysctl.d/99-hardening.conf << EOF
6
# Kernel hardening
7
kernel.dmesg_restrict = 1
8
kernel.kptr_restrict = 2
9
kernel.yama.ptrace_scope = 2
10
kernel.unprivileged_bpf_disabled = 1
11
kernel.unprivileged_userns_clone = 0
12
kernel.sysrq = 0
13
kernel.core_uses_pid = 1
14
kernel.panic = 60
15
kernel.panic_on_oops = 1
16

17
# Module loading restrictions
18
kernel.modules_disabled = 1
19

20
# Memory protections
21
vm.mmap_min_addr = 65536
22
vm.mmap_rnd_bits = 32
23
vm.mmap_rnd_compat_bits = 16
24

25
# Network hardening
26
net.ipv4.tcp_syncookies = 1
27
net.ipv4.tcp_rfc1337 = 1
28
net.ipv4.conf.all.rp_filter = 1
29
net.ipv4.conf.default.rp_filter = 1
30
net.ipv4.conf.all.accept_source_route = 0
31
net.ipv4.conf.default.accept_source_route = 0
32
net.ipv4.conf.all.send_redirects = 0
33
net.ipv4.conf.default.send_redirects = 0
34
net.ipv4.conf.all.accept_redirects = 0
35
net.ipv4.conf.default.accept_redirects = 0
36
net.ipv4.conf.all.secure_redirects = 0
37
net.ipv4.conf.default.secure_redirects = 0
38
net.ipv4.icmp_echo_ignore_broadcasts = 1
39
net.ipv4.icmp_ignore_bogus_error_responses = 1
40
net.ipv4.conf.all.log_martians = 1
41
net.ipv4.conf.default.log_martians = 1
42

43
# IPv6 hardening
44
net.ipv6.conf.all.accept_ra = 0
45
net.ipv6.conf.default.accept_ra = 0
46
net.ipv6.conf.all.accept_redirects = 0
47
net.ipv6.conf.default.accept_redirects = 0
48
EOF
49

50
# Apply settings
51
sysctl -p /etc/sysctl.d/99-hardening.conf
52

53
# Disable kernel module loading
54
echo 1 > /proc/sys/kernel/modules_disabled
55

56
# Set CPU vulnerability mitigations
57
echo "Enabling CPU mitigations..."
58
for vuln in /sys/devices/system/cpu/vulnerabilities/*; do
59
    echo "$(basename $vuln): $(cat $vuln)"
60
done

1
// Custom kernel hardening module
2
#include <linux/module.h>
3
#include <linux/kernel.h>
4
#include <linux/init.h>
5
#include <linux/security.h>
6
#include <linux/cred.h>
7

8
static int hardening_task_create(unsigned long clone_flags)
9
{
10
    const struct cred *cred = current_cred();
11

12
    /* Restrict unprivileged user namespaces */
13
    if ((clone_flags & CLONE_NEWUSER) && !capable(CAP_SYS_ADMIN)) {
14
        pr_warn("Blocked unprivileged user namespace creation\n");
15
        return -EPERM;
16
    }
17

18
    /* Restrict ptrace */
19
    if (clone_flags & CLONE_PTRACE) {
20
        if (!has_capability(current, CAP_SYS_PTRACE)) {
21
            pr_warn("Blocked ptrace attach\n");
22
            return -EPERM;
23
        }
24
    }
25

26
    return 0;
27
}
28

29
static struct security_hook_list hardening_hooks[] __lsm_ro_after_init = {
30
    LSM_HOOK_INIT(task_create, hardening_task_create),
31
};
32

33
static int __init hardening_init(void)
34
{
35
    pr_info("Kernel hardening module loaded\n");
36
    security_add_hooks(hardening_hooks, ARRAY_SIZE(hardening_hooks),
37
                      "hardening");
38
    return 0;
39
}
40

41
module_init(hardening_init);
42
MODULE_LICENSE("GPL");
43
MODULE_DESCRIPTION("Additional kernel hardening");

1
// Kernel lockdown levels
2
enum lockdown_reason {
3
    LOCKDOWN_NONE,
4
    LOCKDOWN_MODULE_SIGNATURE,
5
    LOCKDOWN_DEV_MEM,
6
    LOCKDOWN_EFI_TEST,
7
    LOCKDOWN_KEXEC,
8
    LOCKDOWN_HIBERNATION,
9
    LOCKDOWN_PCI_ACCESS,
10
    LOCKDOWN_IOPORT,
11
    LOCKDOWN_MSR,
12
    LOCKDOWN_ACPI_TABLES,
13
    LOCKDOWN_PCMCIA_CIS,
14
    LOCKDOWN_TIOCSSERIAL,
15
    LOCKDOWN_MODULE_PARAMETERS,
16
    LOCKDOWN_MMIOTRACE,
17
    LOCKDOWN_DEBUGFS,
18
    LOCKDOWN_XMON_WR,
19
    LOCKDOWN_KCORE,
20
    LOCKDOWN_KPROBES,
21
    LOCKDOWN_BPF_READ,
22
    LOCKDOWN_PERF,
23
    LOCKDOWN_TRACEFS,
24
    LOCKDOWN_XMON_RW,
25
    LOCKDOWN_CONFIDENTIALITY_MAX,
26
};
27

28
static int lockdown_is_locked_down(enum lockdown_reason what)
29
{
30
    if (kernel_locked_down >= what) {
31
        pr_warn("Lockdown: %s is restricted; see man kernel_lockdown.7\n",
32
                lockdown_reasons[what]);
33
        return -EPERM;
34
    }
35

36
    return 0;
37
}

1
// Performance measurement module
2
#include <linux/time64.h>
3
#include <linux/timekeeping.h>
4

5
struct mitigation_stats {
6
    u64 total_cycles;
7
    u64 total_calls;
8
    u64 max_cycles;
9
};
10

11
static DEFINE_PER_CPU(struct mitigation_stats, kpti_stats);
12
static DEFINE_PER_CPU(struct mitigation_stats, retpoline_stats);
13

14
#define MEASURE_MITIGATION(name, code) ({                          \
15
    struct mitigation_stats *stats = this_cpu_ptr(&name##_stats);  \
16
    u64 start = rdtsc();                                           \
17
    code;                                                          \
18
    u64 delta = rdtsc() - start;                                  \
19
    stats->total_cycles += delta;                                  \
20
    stats->total_calls++;                                          \
21
    if (delta > stats->max_cycles)                                \
22
        stats->max_cycles = delta;                                 \
23
})
24

25
// Usage example
26
static void measured_context_switch(void)
27
{
28
    MEASURE_MITIGATION(kpti, {
29
        switch_to_kernel_cr3();
30
        /* Context switch code */
31
        switch_to_user_cr3();
32
    });
33
}

1
#!/usr/bin/env python3
2
# test_mitigations.py - Test kernel exploit mitigations
3

4
import os
5
import subprocess
6
import ctypes
7
import mmap
8

9
class KernelMitigationTester:
10
    def __init__(self):
11
        self.results = {}
12

13
    def test_kaslr(self):
14
        """Test KASLR effectiveness"""
15
        try:
16
            # Check for KASLR in cmdline
17
            with open('/proc/cmdline', 'r') as f:
18
                cmdline = f.read()
19
                if 'nokaslr' in cmdline:
20
                    return False, "KASLR disabled in boot parameters"
21

22
            # Check kernel offset
23
            with open('/proc/kallsyms', 'r') as f:
24
                first_symbol = f.readline().split()[0]
25
                if first_symbol == '0000000000000000':
26
                    return False, "kallsyms not available"
27

28
                # Check for randomization
29
                addr = int(first_symbol, 16)
30
                if (addr & 0xFFFFFF) != 0:
31
                    return True, "KASLR active"
32

33
        except Exception as e:
34
            return False, f"Error: {e}"
35

36
        return False, "KASLR status unknown"
37

38
    def test_nx(self):
39
        """Test NX bit enforcement"""
40
        try:
41
            # Check CPU support
42
            with open('/proc/cpuinfo', 'r') as f:
43
                if 'nx' not in f.read():
44
                    return False, "CPU doesn't support NX"
45

46
            # Test actual enforcement
47
            shellcode = b"\x31\xc0\xc3"  # xor eax,eax; ret
48

49
            # Create executable mapping
50
            buf = mmap.mmap(-1, len(shellcode),
51
                           prot=mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC)
52
            buf.write(shellcode)
53

54
            # This should work
55
            cfunc = ctypes.CFUNCTYPE(ctypes.c_int)(ctypes.addressof(ctypes.c_char.from_buffer(buf)))
56

57
            # Create non-executable mapping
58
            buf2 = mmap.mmap(-1, len(shellcode),
59
                            prot=mmap.PROT_READ | mmap.PROT_WRITE)
60
            buf2.write(shellcode)
61

62
            # This should fail
63
            try:
64
                cfunc2 = ctypes.CFUNCTYPE(ctypes.c_int)(ctypes.addressof(ctypes.c_char.from_buffer(buf2)))
65
                cfunc2()
66
                return False, "NX not enforced"
67
            except:
68
                return True, "NX properly enforced"
69

70
        except Exception as e:
71
            return False, f"Error testing NX: {e}"
72

73
    def test_smep(self):
74
        """Test SMEP (Supervisor Mode Execution Prevention)"""
75
        try:
76
            with open('/proc/cpuinfo', 'r') as f:
77
                if 'smep' in f.read():
78
                    return True, "SMEP supported and likely enabled"
79
                else:
80
                    return False, "SMEP not supported by CPU"
81
        except:
82
            return False, "Could not determine SMEP status"
83

84
    def test_smap(self):
85
        """Test SMAP (Supervisor Mode Access Prevention)"""
86
        try:
87
            with open('/proc/cpuinfo', 'r') as f:
88
                if 'smap' in f.read():
89
                    return True, "SMAP supported and likely enabled"
90
                else:
91
                    return False, "SMAP not supported by CPU"
92
        except:
93
            return False, "Could not determine SMAP status"
94

95
    def test_kpti(self):
96
        """Test KPTI (Kernel Page Table Isolation)"""
97
        try:
98
            with open('/sys/devices/system/cpu/vulnerabilities/meltdown', 'r') as f:
99
                status = f.read().strip()
100
                if 'Mitigation: PTI' in status:
101
                    return True, "KPTI enabled"
102
                elif 'Vulnerable' in status:
103
                    return False, "KPTI disabled - system vulnerable"
104
                else:
105
                    return True, f"Status: {status}"
106
        except:
107
            return False, "Could not determine KPTI status"
108

109
    def run_all_tests(self):
110
        """Run all mitigation tests"""
111
        tests = [
112
            ('KASLR', self.test_kaslr),
113
            ('NX/DEP', self.test_nx),
114
            ('SMEP', self.test_smep),
115
            ('SMAP', self.test_smap),
116
            ('KPTI', self.test_kpti),
117
        ]
118

119
        print("Kernel Security Mitigation Tests")
120
        print("=" * 40)
121

122
        for name, test_func in tests:
123
            passed, message = test_func()
124
            status = "PASS" if passed else "FAIL"
125
            print(f"{name:.<30} [{status}] {message}")
126
            self.results[name] = passed
127

128
        print("=" * 40)
129
        passed = sum(self.results.values())
130
        total = len(self.results)
131
        print(f"Summary: {passed}/{total} tests passed")
132

133
if __name__ == '__main__':
134
    tester = KernelMitigationTester()
135
    tester.run_all_tests()

1
#!/bin/bash
2
# Check for security updates
3
check_kernel_updates() {
4
    current=$(uname -r)
5
    echo "Current kernel: $current"
6

7
    # Check for CVEs
8
    echo "Checking for known vulnerabilities..."
9
    for cve in /sys/devices/system/cpu/vulnerabilities/*; do
10
        vuln=$(basename $cve)
11
        status=$(cat $cve)
12
        echo "$vuln: $status"
13
    done
14

15
    # Check for available updates
16
    if command -v apt-get >/dev/null; then
17
        apt-get update
18
        apt-cache policy linux-image-generic
19
    elif command -v yum >/dev/null; then
20
        yum check-update kernel
21
    fi
22
}

1
// Kernel security event monitor
2
static int security_event_notify(struct notifier_block *nb,
3
                               unsigned long action, void *data)
4
{
5
    switch (action) {
6
    case SECURITY_KERNEL_MODULE_LOAD:
7
        pr_warn("Kernel module loaded\n");
8
        break;
9
    case SECURITY_KERNEL_READ:
10
        pr_warn("Kernel memory read attempt\n");
11
        break;
12
    case SECURITY_LOCKDOWN_VIOLATION:
13
        pr_warn("Lockdown violation\n");
14
        break;
15
    }
16

17
    return NOTIFY_OK;
18
}