nixos/hardened profile: slab/slub hardening
slab_nomerge may reduce surface somewhat slub_debug is used to enable additional sanity checks and "red zones" around allocations to detect read/writes beyond the allocated area, as well as poisoning to overwrite free'd data. The cost is yet more memory fragmentation ...
This commit is contained in:
parent
d62086e6fc
commit
3f1f443125
|
@ -29,6 +29,12 @@ with lib;
|
||||||
security.apparmor.enable = mkDefault true;
|
security.apparmor.enable = mkDefault true;
|
||||||
|
|
||||||
boot.kernelParams = [
|
boot.kernelParams = [
|
||||||
|
# Slab/slub sanity checks, redzoning, and poisoning
|
||||||
|
"slub_debug=FZP"
|
||||||
|
|
||||||
|
# Disable slab merging to make certain heap overflow attacks harder
|
||||||
|
"slab_nomerge"
|
||||||
|
|
||||||
# Overwrite free'd memory
|
# Overwrite free'd memory
|
||||||
"page_poison=1"
|
"page_poison=1"
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue