linux VS linux-hardened

I reached to Arch's kernel repository and found that device.h exists.

bash $ pacman -Q --info linux-headers Name : linux-headers Version : 6.2.11.arch1-1 Description : Headers and scripts for building modules for the Linux kernel Architecture : x86_64 URL : https://github.com/archlinux/linux/commits/v6.2.11-arch1 Licenses : GPL2 Groups : None Provides : None Depends On : pahole Optional Deps : None Required By : None Optional For : dkms Conflicts With : None Replaces : None Installed Size : 158.24 MiB Packager : Jan Alexander Steffens (heftig) Build Date : Thu 13 Apr 2023 06:59:24 PM CEST Install Date : Wed 19 Apr 2023 09:32:40 AM CEST Install Reason : Explicitly installed Install Script : No Validated By : Signature

So, the "bleeding edge" of https://github.com/archlinux/linux? That's going to just get you a release candidate of the mainline kernel, with no Arch-specific patches. You can get that on NixOS by using linuxPackages_testing.

Thanks for the suggestion. I'm guessing I have to do it with the Arch Linux fork of the linux kernel?

I've now downloaded v6.0.2-arch1 and confirmed the patch isn't applied. Idk why but will check on archs forums.

I've confirmed that in v6.0.2-arch1 the patch isn't applied. But it is on the master branch.

$ pacman -Qii linux Name : linux Version : 6.0.arch1-1 Description : The Linux kernel and modules Architecture : x86_64 URL : https://github.com/archlinux/linux/commits/v6.0-arch1 Licenses : GPL2 Groups : None Provides : VIRTUALBOX-GUEST-MODULES WIREGUARD-MODULE KSMBD-MODULE Depends On : coreutils kmod initramfs Optional Deps : wireless-regdb: to set the correct wireless channels of your country linux-firmware: firmware images needed for some devices [installed] Required By : nvidia Optional For : base Conflicts With : None Replaces : virtualbox-guest-modules-arch wireguard-arch Installed Size : 163.52 MiB Packager : Jan Alexander Steffens (heftig) Build Date : Tue 04 Oct 2022 03:16:52 PM EDT Install Date : Wed 05 Oct 2022 04:35:19 AM EDT Install Reason : Explicitly installed Install Script : No Validated By : Signature Backup Files : (none)

Lately there appear to be changes in Arch as well, making it hard to keep up as well. Let's examine for example the kernel building. It was the tradition and commitment by arch to use direct source from upstream, and only modify what is necessary to make software comply with the entire distro. Now, with linux-5.19 appearing, and maybe with the last versions of 5.18, instead of using directly a tar ball from kernel.org Arch is using its own source library https://github.com/archlinux/linux/tags made by forking Torvalds' git. The traditional config file is gone, and all configuration and patching takes place at Arch's forked source.

It's not present in 5.15/16 and i noticed that lockdep_assert_preemption_disabled was added in the 5.17. As arch's kernel is by default PREEMPT_DYNAMIC, tried preempt=voluntary and the warnings went away.

Glossing over their hardening guide, we notice that the kernel-hardened package is mentioned. This is a fork of what once was the kernel of GrapheneOS. While this hardened kernel can be used on a variety of distros, unfortunately this doesn't apply to Fedora Silverblue. Furthermore, I haven't seen any mention of the hardened kernel being used on openSUSE Tumbleweed. Therefore I see no reason to believe that this is possible on openSUSE Aeon either. Though, I'd love to be corrected on this!

Here's the GitHub page for the linux-hardened package in the official Arch repos. You will find that lots of changes come from GrapheneOS. "Forked from GrapheneOS" is in tiny, tiny text near the top-left of the web page underneath the project name.

Here is the source code for the hardened Linux kernel.

so that we can use it liberally in CLI) > **Additionally, here's a 'building from the source section** - https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md#building-from-source ### Running Firecracker > "*In production, Firecracker is designed to be run securely, inside an execution jail, carefully set up by the jailer binary. This is how our integration test suite does it. However, if you just want to see Firecracker booting up a guest Linux machine, you can do that as well.*" 1. We need to first obtain an "uncompressed Linux kernel binary, and an ext4 file system image (to use as rootfs)" ; great, these are two things that we need to seek out before we move forward in our 'adventure' (*this really feels like a "quest" of some sort, like the ones that they forced you to play on Runescape back in the days*) **How to Decompress Linux Kernel** (explicit instructions to be honest here) - https://0xax.gitbooks.io/linux-insides/content/Booting/linux-bootstrap-5.html **Linux-Hardened Kernel** - https://github.com/anthraxx/linux-hardened (this is something that they're all still actively working on at this very point in time) They also say that we need an 'ext4 file system image' (where do we obtain this from?) - found it **Full Guide on How to Create an EXT4 filesystem image here** -https://fabianlee.org/2020/01/13/linux-mounting-a-loopback-ext4-xfs-filesystem-to-isolate-or-enforce-storage-limits/ Assuming that the above has been handled, the directions insist that we create two separate shell prompts, (one to run Firecracker, and another one to control it [by writing to the API socket]; both shells have to run "in the same directory where the firecracker binary was placed") ^^ What? - This is a pain in the ass because this is something that they should've mentioned earlier (obv. everyone is going to move a binary where the rest of their binaries go ; and you're not going to just load up some random project to be used in that manner) - Not even sure what the end goal of opening up an API socket here would really be But fuck it, let's just assume that we play ball and we adhere to all of these (additional) steps that we're being put through (just for the setup up this virtualization tool!). ### Following Through on the Next Steps 1. Ensuring that Firecracker can create its own API ``` bash rm -f /tmp/firecracker.socket

Officially supported kernels Community support on forum and bug reporting is available for officially supported kernels. Stable — Vanilla Linux kernel and modules, with a few patches applied. https://www.kernel.org/ || linux Hardened — A security-focused Linux kernel applying a set of hardening patches to mitigate kernel and userspace exploits. It also enables more upstream kernel hardening features than linux. https://github.com/anthraxx/linux-hardened || linux-hardened Longterm — Long-term support (LTS) Linux kernel and modules. https://www.kernel.org/ || linux-lts Zen Kernel — Result of a collaborative effort of kernel hackers to provide the best Linux kernel possible for everyday systems. Some more details can be found on https://liquorix.net (which provides kernel binaries based on Zen for Debian). https://github.com/zen-kernel/zen-kernel || linux-zen

Overall those patches do protect you in a lot of cases. Per default upstream features are chose to honor security first. Furthermore patches do frequently protect against upstream failures and vulnerabilities. One of the latest examples is CVE-2022-1729 https://seclists.org/oss-sec/2022/q2/122 a local privilege vulnerability that linux-hardened simply protects since before day 0: https://github.com/anthraxx/linux-hardened/commit/4dd6bdf3b079ef73e597661ee961d225bfccbe2a On top the approach in several places of fail-early instead of potentially continuing with known corruption or certain use-after-free regularly uncovers problems that get fixed upstream and where the vanilla kernels just keep on running, which include exploitable problems. One example of a faulty very recent commit that has been bisected and fixed because of linux-hardened: https://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git/commit/?h=for-next&id=acde4003efc16480375543638484d8f13f2e99a3

Those two don't protect the kernel itself from "misuse". To do that, there are ways like kernel hardening 3, using hardened kernel 4 5.