DEFAULT KERNEL OPTIONS
With this command we can check the boot loader options. It offers normally two kernel load types, one classic and one secure load and some of the options coming with it:
$ grep linuz /boot/grub2/grub.cfg | head -1
$ cat /etc/default/grub
Options:
- rhgb = graphical screen
- quiet = hide most of the messages
- LVM Partitionning
- language and encoding
============================================================
PROTECT THE MEMORY FROM SYSTEM PERIPHERAL ACCESS
Memory Isolation: IOMMU ensures that peripheral devices cannot access arbitrary areas of system memory, which is crucial for maintaining data integrity and security.
Protection Against DMA Attacks: Direct Memory Access (DMA) attacks exploit the ability of devices to read/write directly to memory. Without IOMMU, a malicious device could potentially read sensitive data or inject malicious code. IOMMU restricts this capability.
Virtualization Security: In virtualized environments, IOMMU is critical for assigning devices to virtual machines securely, preventing them from accessing memory outside their allocated spaces.
$ nano /etc/default/grub
-----------------------------------
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=centos_file-s/root rd.lvm.lv=centos_file-s/swap rhgb quiet"
GRUB_DISABLE_RECOVERY="true"
-----------------------------------
# add this "iommu=force" (Input-Output Memory Management Unit):
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=centos_file-s/root rd.lvm.lv=centos_file-s/swap rhgb quiet iommu=force"
================================================
SUPPLEMENTARY BLOCKAGE OF MODULE LOADING
Prevention of Malicious Modules: By disabling the loading of new kernel modules, you prevent attackers from injecting malicious modules into the kernel. These modules could be used to execute arbitrary code, escalate privileges, or conceal malicious activities (rootkits).
System Integrity: Ensuring that only the necessary and verified modules are loaded at boot time helps maintain the integrity of the operating system. Disabling module loading reduces the attack surface.
Compliance and Control: For systems that require strict compliance with security policies (e.g., PCI-DSS, HIPAA), having the ability to disable module loading helps enforce these policies and control the system environment more tightly.
$ sysctl kernel.modules_disabled
# this will show us the actual state of module access
# kernel.modules_disabled = 0 -> it is zero, meaning accessible
$ sysctl -w kernel.modules_disabled=1
# this command will disable it for the current instance
# it will be though put back to zero and active after reboot
$ echo "kernel.modules_disabled = 1" >> /etc/sysctl.conf
$ nano /etc/sysctl.conf
add : kernel.modules_disabled = 1
NOTE: This may prevent certain updates of the kernel itself, kernel modules, hardware drivers and so. Temporarily these can be disabled, for updates and upgrades. As it affects only "new" modules", disabling it will not remove the loading of already installed and updated components. Yes, set it to zero, do your updates and upgrades. Reboot, set it back to 1, reboot. Off you go.
