Set the following sysctls:

kernel.panic_on_oops = 1
kernel.panic_on_warn = 1

Enable CONFIG_SECURITY_YAMA in your kernel config.

Set /proc/sys/kernel/yama to either:

• “1”:  Only child processes can be debugged
• “2”:  Only processes with CAP_SYS_PTRACE can debug anymore
• “3”:  Disable debugging completely (Once set, cannot undo anymore)

Set in your kernel config:

CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE_OVERRIDE=y
CONFIG_CMDLINE="root=/dev/sda1"

Set the following sysctl:

kernel.modprobe = ""

Set in your kernel config:

CONFIG_RANDOMIZE_BASE=y

Set the kernel.kptr_restrict sysctl to either:

“1”: Only users with CAP_SYSLOG see real addresses, everybody else zeros

“2”: Everyone sees just zeros

Set the following sysctl:

kernel.dmesg_restrict = 1

Do not use this:

foo = realloc(foo, ...);

Instead do this:

ret = realloc(foo, ...);
if (ret == NULL) {
    // [...] handle error
    free(foo);
    return ENOMEM;
}
foo = ret;

Use this:

static inline void cln_fptr(FILE **f) {
    fclose(*f);
}
static void foo(void) {
     __attribute__((cleanup(cln_fptr))) FILE *f;
    f = fopen("/etc/passwd", "r");
    // [...]
}

Instead, use Argon2

Key+Nonce reuse will break the security properties of the cipher.

Otherwise, attackers launch timing assaults
against your code.

Depending on your project, use one of these CLI commands to check for outdated dependencies:

$ npm audit 
$ govulncheck ./... 
$ cargo audit

Compile with those flags:

-O2 -D_FORTIFY_SOURCE=2

 
to enable basic bounds checks for functions like memcpy or strcpy.

Don’t do TCP/UDP on localhost, instead use AF_UNIX.

Instead of this:

int foo();

Declare it like this:

int foo(void);

Here’s an example:

$ echo "Hello, world" > /dev/kmsg
[734626.551208] Hello, world

Combine them like that:

# gcc/clang:
$ $CC -fsanitize=address -fsanitize=undefined \
  $CFLAGS

# meson (> 0.55.0):
$ meson compile  -Db_sanitize=address,\
  undefined

Apply it like that:

$ ASAN_OPTIONS="log_path=asan.log" ./a.out
$ cat asan.log.438963

Use Argon2id with a recommended, universal option
(if acceptable for your use case).

Or tailor to your own Argon2id parameter set
using guide from RFC9106 section 4.

Can you find the security problem in this Go snippet?

import "math/rand"
func generateAES256Key() ([]byte, error) {
    var key = make([]byte, 32)
    if _, err := rand.Read(key); err != nil {
        return nil, err
    }
    return key, nil
}

dtc -I fs -O dts /proc/device-tree

Enable it like that:

gcc/clang:

$ $CC -fsanitize=address $CFLAGS ...

meson (> 0.55.0):

$ meson compile -Db_sanitize=address ...

Enable it like that:

gcc/clang:

$ $CC -fsanitize=undefined $CFLAGS ...

meson (> 0.55.0):

$ meson compile -Db_sanitize=undefined ...

With cryptsetup:

$ cryptsetup --perf-no_read_workqueue \
     --perf-no_write_workqueue \
     open /dev/disk name

With crypttab, add these options:

> no-read-workqueue
> no-write-workqueue

At rootfs mount, add to kernel command line:

> rootfstype=TYPE

At userspace, fstab:

/dev/disk /mount/point TYPE defaults 0 0

At userspace, manual mount:

$ mount -t TYPE /dev/disk /mnt/point

dm-verity

Makes sure every single sector on a block device is authenticated.
It has little overhead but allows no writes!

dm-integrity

Like dm-verity, but offers full read- write access.
It has more overhead since it needs to
maintain a journal!

Keep in mind:

Although an attacker cannot read your data,
they can change it! While it’s hard to do,
attackers can exchange blocks
on encrypted disks.

Consider using dm-verity/integrity too!

Use following commands and compare the outputs:

# List init process namespaces
readlink /proc/1/ns/*

# List target process namespaces (replace <pid>)
readlink /proc/<pid>/ns/*

Get a Debian VM in QEMU in seconds:

$ wget https://cloud.debian.org/images/cloud/ \
    trixie/latest/debian-13-nocloud-amd64.raw
$ qemu-system-x86_64 -M pc,accel=kvm -m 1G \
        -drive file=debian-13-nocloud-amd64.raw,if=virtio \
        -netdev type=user,hostfwd=tcp::2222-:22,id=net0 \
        -device virtio-net,netdev=net0 -smp 4 -nographic
# Upon first boot, root password is configured
VM$ apt update && apt install openssh-server
VM$ echo "PermitRootLogin yes" > \
        /etc/ssh/sshd_config.d/root_login.conf
VM$ systemctl restart sshd
$ ssh root@localhost -p 2222

Run these commands:

# The disk image was deleted by accident
$ ls /srv/disk1.raw
ls: cannot access '/srv/disk1.raw': No such file or directory

# Luckily, PID 1257 still has a reference
$ readlink /proc/1257/fd/* | grep disk
/srv/disk1.raw (deleted)

# Make sure the process does not alter it
# while we read it back
$ kill -STOP 1257

# Read it back
$ cat /proc/1257/fd/18 > /srv/disk1.raw

Example: A rootkit camouflages itself as httpd:

$ /tmp/rootkit --do=evil --foo bar & 
[1] 21528
$ ps -o pid,args --pid=21528
  PID COMMAND
21528 httpd -DSYSCONFIG
$ cat /proc/21528/cmdline
httpd -DSYSCONFIG

Read container files via procfs:

$ ps fax
[...]
24320 ?     Sl  1:26 /usr/sbin/containerd-shim-runc-v2 [...]
24341 pts/0 Ss+ 0:00  \_ /bin/bash /entry.sh
[...]

$ cat /proc/24341/root/entry.sh
#!/bin/bash
set -e
supervisord -c /etc/supervisord.conf

$ cat /proc/24341/root/etc/hostname
somecontainer

A shell camouflages itself as arpd

$ unshare -Umr
$ mount --bind /bin/bash /usr/sbin/arpd
$ exec /usr/sbin/arpd
$ # A hidden shell

Inspecting the camouflaged process

$ pidof arpd
1692
$ readlink /proc/1692/exe
/usr/sbin/arpd
$ readlink /proc/$$/ns/mnt /proc/1692/ns/mnt
mnt:[4026531840]
mnt:[4026533296]

Bubblewrap at a glance

• Sandbox is defined via command line options
• Starts with an empty filesystem, host paths are opt-in
• NO_NEW_PRIVS bit is set
• Allows also isolating other namespaces such as networking

Example: Allow everything, but /mnt

$ bwrap --bind / / --tmpfs /mnt /bin/sh

Linux Kernel Versioning: X.Y.Z

• X: Incremented when Y reaches 20
• Y: Incremented with every release by Linus Torvalds
• Z: Incremented with every release by the stable team

Internal Changes Happen Constantly

• “major” number is irrelevant to compatibility
• Big API changes can happen in any time
• The user-visible ABI is set in stone