The Linux Kernel/Security

New features Lockdown Since Linux 5.4. ⚲ API: /sys/kernel/security/lockdown 7 kernel_lockdown – kernel image access prevention feature Landlock Landlock (Linux security module) Landlock allows unprivileged processes to sandbox themselves by restricting file access, networking, and other operations (since 5.13). ⚲ API 2 landlock_create_ruleset – create a ruleset 2 landlock_add_rule – add a rule to a ruleset 2 landlock_restrict_self – apply ruleset to current process uapi/linux/landlock.h ⚙️ Internals security/landlock tools/testing/selftests/landlock 👁 Example: samples/landlock/sandboxer.c 📚 References: Landlock: unprivileged access control userspace-api/landlock.html Landlock security/landlock.html Hardening linux/randomize_kstack.h add_random_kstack_offset 2 mseal ↪ sys_mseal – seal memory mappings against modifications (since 6.10) 2 memfd_secret ↪ sys_memfd_secret – memory hidden from the kernel (since 5.14) Cryptographic API See Cryptography for the full crypto API section. /proc/crypto – registered algorithms with driver, module, priority and selftest status /proc/sys/crypto/fips_enabled – indicates FIPS 140 mode is active sos crypto plugin – diagnostics collection for crypto subsystem Hardware random number generator ⚲ API /dev/hwrng – hwrng device /sys/class/misc/hw_random/rng_current – active hwrng /sys/class/misc/hw_random/rng_available – available hwrngs linux/hw_random.h – devm_hwrng_register, hwrng_register Sources: RDRAND / RDSEED – x86 on-chip, see CPU features Intel/AMD chipset RNG TPM – also provides hwrng VirtIO – virtual hwrng for guests ⚙️ Internals drivers/char/hw_random – hwrng drivers Trusted Platform Module TPM A Trusted Platform Module is a hardware security chip that provides secure key storage, platform integrity measurement (measured boot), and hardware random number generation. ⚲ API /dev/tpm0 – TPM device node /dev/tpmrm0 – TPM resource manager (recommended, handles sessions) /sys/class/tpm/ linux/tpm.h ⚙️ Internals drivers/char/tpm – TPM subsystem security/integrity/ima – Integrity Measurement Architecture security/IMA-templates.html, uses TPM for measured boot drivers/char/tpm/tpm-chip.c – tpm_hwrng_read, TPM as hwrng source 📖 References TPM FIFO interface driver security/tpm/tpm_ftpm_tee.html Trusted Platform Module Hardware vulnerability mitigations CPU Speculative execution speculative execution mitigations for vulnerabilities like Spectre (security vulnerability) Spectre, Microarchitectural Data Sampling MDS, Retbleed SRSO, Virtual machine escape VMSCAPE. These mitigations can impact real-time latency. 🗝️ Acronyms IBPB – Indirect Branch Prediction Barrier, flushes branch predictor on context switches to prevent cross-process speculation attacks IBRS – Indirect Branch Restricted Speculation STIBP – Single Thread Indirect Branch Predictors SSBD – Speculative Store Bypass Speculative Store Bypass Disable ⚲ API /sys/devices/system/cpu/vulnerabilities/ ⚙️ Internals arch/x86/kernel/cpu/bugs.c – x86 CPU bug mitigations 📖 References Hardware vulnerabilities admin-guide/hw-vuln