onkq / hardened-kernel

Hardened kernel configuration optimized for virtual machines. - https://www.kicksecure.com/wiki/Hardened-kernel

Hardened Kernel for Host and VMs

This is a hardened kernel configuration for Whonix / Kicksecure. hardened-vm-kernel is designed specifically for virtual machines and hardened-host-kernel is designed for hosts.

Both configs try to have as many hardening options enabled as possible and have little attack surface. hardened-vm-kernel only has support for VMs and all other hardware options are disabled to reduce attack surface and compile time.

During installation of hardened-vm-kernel, it compiles the kernel on your own machine and does not use a pre-compiled kernel. This ensures the kernel symbols in the compiled image are completely unique which makes it far harder for kernel exploits. This is possible due to hardened-vm-kernel having only VM config options enabled which drastically reduces compile time.

During installation of hardened-host-kernel, the kernel is not compiled on your machine and it uses a pre-compiled kernel. This is because the host kernel needs most hardware options enabled to support most devices which makes compilation take a very long time.

The VM kernel is more secure than the host kernel due to having less attack surface and not being pre-compiled but if you want more security for the host, it is recommended to edit the hardened host config, enable only the hardware options you need and compile the kernel yourself. This makes the security of the host and VM kernel comparable.

Both configs were based on the default Debian config.

These kernels use the linux-hardened patch for further hardening. Custom hardening patches should be sent there.

This only supports LTS kernels as they have the least attack surface (stable kernels have more code and more bugs) and the best stability.

Build script /usr/share/hardened-vm-kernel/build does not run automatic yet.

Kernel does not get installed automatic yet.

See also development discussion: http://forums.whonix.org/t/kernel-recompilation-for-better-hardening

How to install hardened-kernel using APT

1. Download the APT Signing Key.

wget https://www.kicksecure.com/keys/derivative.asc

Users can check the Signing Key for better security.

2. Add the APT Signing Key.

sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc

3. Add the derivative repository.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

4. Update your package lists.

sudo apt update

5. Install hardened-kernel.

sudo apt install hardened-kernel

How to Build deb Package from Source Code

Can be build using standard Debian package build tools such as:

dpkg-buildpackage -b

See instructions.

NOTE: Replace generic-package with the actual name of this package hardened-kernel.

• A) easy, OR
• B) including verifying software signatures

After Installation (Actually install the kernel)

Go to your /usr/share/hardened-kernel/ folder.

There you should see a download and build file, open up both; first build.

Using nano build we only need to change the version="" in that build file to the current version of the linux-hardened or whatever version you prefer. By going to linux-hardened GitHub site, we wanna note the latest supported release for patching the kernel. Today it's 6.4.3

Now change the version="" to version="6.4.3" and now save and exit the file.

Open up download using nano download and here we need to change alot of things, depending on the name extension from linux-hardened. Which is currently 6.4.3-hardened1 We need to change corresponding to that inside the download file. Let me show you:

First, change the version="" to version="6.4.3" inside the download file.

Secondly, change the v4.x, or depending on which version it shows for you, to the latest, so v6.x for me. Don't change the x. Do that to all three of the URLs.

Thirdly, change the .a, or depending on what it shows, to the corresponding file extension on the linux-hardened Github page.

So that would be: -hardened1

If you got this far into the tutorial, nice!

Now we can run the command build --host or build --vm depending on which it is. Wait for it to finish, explanation on what the difference is, you got at the top of this page.

Here on out, remember to change the version to your own version.

Change to directory /usr/src/hardened-kernel/files and run tar -xf linux-6.4.3.tar.xz,

Change to newly created directory cd linux-6.4.3

Run the patch patch -p1 < ../linux-hardened-6.4.3-hardened1.patch

Configure the Kernel make oldconfig

• Accept the defaults by pressing Enter. Or configure if u like.

Build the Kernel make -j$(nproc)

Install the Kernel modules make modules_install

Install the Kernel Image make install

Update the GRUB update-grub

You've made it!

You can check if it's available to use using ls /boot/vmlinuz*

Then reboot reboot (optional)