// docs

Hardening

Hardening is applied through plain-text files in the build's overlay. To audit it, just read them or compare them with diff. This page summarises each one.

Kernel command line

Every GRUB entry carries these parameters (build.sh adds them to config/grub.cfg):

Parameter	Effect
`lockdown=confidentiality`	Not even root can read kernel memory or load unsigned code into it.
`init_on_alloc=1`	Memory is zeroed when allocated.
`init_on_free=1`	Memory is zeroed when freed: less data to recover in a cold boot attack.
`slab_nomerge`	Does not merge kernel allocator caches, which makes overflows harder to exploit.
`page_alloc.shuffle=1`	Randomises the free page lists.
`randomize_kstack_offset=on`	Random kernel stack offset on every system call.
`pti=on`	Kernel page-table isolation (Meltdown).
`mitigations=auto,nosmt`	CPU mitigations enabled and SMT (hyper-threading) disabled where needed.
`vsyscall=none`	Removes the legacy fixed-address `vsyscall` page.
`debugfs=off`	No `debugfs`.
`apparmor=1 security=apparmor`	Enables AppArmor as the security module.
`ipv6.disable=1`	IPv6 completely disabled.

sysctl

File: /etc/sysctl.d/99-redderos-hardening.conf.

Kernel

Key	Value	Effect
`kernel.kptr_restrict`	`2`	Hides kernel addresses, from root as well.
`kernel.dmesg_restrict`	`1`	Only root can read the kernel log.
`kernel.printk`	`3 3 3 3`	Only serious errors on the console.
`kernel.unprivileged_bpf_disabled`	`1`	BPF for root only.
`net.core.bpf_jit_harden`	`2`	Hardens the BPF JIT compiler.
`kernel.kexec_load_disabled`	`1`	No other kernel can be loaded at runtime.
`kernel.yama.ptrace_scope`	`2`	Only root can debug other processes.
`kernel.perf_event_paranoid`	`3`	No `perf` for normal users.
`kernel.sysrq`	`0`	Magic SysRq keys disabled.
`kernel.core_pattern`	`\|/bin/false`	No core dump is ever written.
`kernel.unprivileged_userns_clone`	`0`	No user namespaces for normal users.
`dev.tty.ldisc_autoload`	`0`	Line disciplines are not loaded on demand.
`vm.unprivileged_userfaultfd`	`0`	`userfaultfd` for root only.
`vm.swappiness`	`0`	Do not use swap (and there is none anyway).

File system

Key	Value	Effect
`fs.protected_symlinks`	`1`	Protects against symbolic link tricks in `/tmp`.
`fs.protected_hardlinks`	`1`	Likewise for hard links.
`fs.protected_fifos`	`2`	Likewise for FIFOs.
`fs.protected_regular`	`2`	Likewise for regular files.
`fs.suid_dumpable`	`0`	`setuid` programs do not produce core dumps.

Network

Key	Value	Effect
`net.ipv4.tcp_syncookies`	`1`	Withstands SYN floods.
`net.ipv4.tcp_rfc1337`	`1`	TIME-WAIT protection (RFC 1337).
`net.ipv4.tcp_timestamps`	`0`	No TCP timestamps, which give away the clock.
`net.ipv4.conf.*.rp_filter`	`1`	Drops packets with a spoofed source.
`net.ipv4.conf.*.accept_redirects`	`0`	Ignores ICMP redirects.
`net.ipv4.conf.all.secure_redirects`	`0`	Likewise, including "secure" ones.
`net.ipv4.conf.all.send_redirects`	`0`	Does not send redirects.
`net.ipv4.conf.all.accept_source_route`	`0`	Ignores source routing.
`net.ipv4.icmp_echo_ignore_all`	`1`	Does not answer `ping`.
`net.ipv4.ip_forward`	`0`	Does not forward traffic.

The self-test checks that each key has the expected value (keys that do not exist in the running kernel are skipped, and this is reported).

Blocked modules

File: /etc/modprobe.d/redderos-blacklist.conf. Each module is replaced by /bin/false, so it cannot be loaded even by hand.

Group	Modules
Rarely used network protocols	`dccp`, `sctp`, `rds`, `tipc`, `n-hdlc`, `ax25`, `netrom`, `x25`, `rose`, `decnet`, `econet`, `af_802154`, `ipx`, `appletalk`, `psnap`, `p8022`
Rarely used file systems	`cramfs`, `freevxfs`, `jffs2`, `hfs`, `hfsplus`, `udf`
External DMA and wireless peripherals	`firewire-core`, `thunderbolt`, `bluetooth`, `btusb`

The camera (uvcvideo) has a line ready but commented out: uncomment it in the build to disable it completely.

AppArmor

Debian and Ubuntu do not load AppArmor profiles on live systems. RedderOS overrides that condition (/etc/systemd/system/apparmor.service.d/redderos-live.conf) and loads the profiles from apparmor-profiles.

Amnesia: systemd and limits

File	Effect
`systemd/journald.conf.d/redderos.conf`	Logs in RAM only (32 MB maximum), not forwarded to syslog.
`systemd/coredump.conf.d/redderos.conf`	No core dumps.
`systemd/system.conf.d/redderos.conf`	`DefaultLimitCORE=0` for everything systemd starts.
`security/limits.d/redderos.conf`	Core dump limit set to 0 for all users.
`systemd/logind.conf.d/redderos.conf`	No user process survives logout.

The build also masks the apt, motd-news, e2scrub and fstrim timers, and disables the live-system scripts that enable swap on the computer's disk, crash reporting (apport) and pollinate.

Users and privileges

root is locked: you cannot log in as root.
anon, the amnesic session user, has no password and no sudo. Only the Temporary administrator entry gives it sudo, and only for that session.
The one exception is redder-wipe: any user can run it as root without a password and without arguments (/etc/sudoers.d/redderos-wipe). It only wipes RAM and shuts down.
Profile users are created in RAM when the profile is opened and deleted when it is closed.
umask 077: new files can only be read by their owner.

Without administrator rights, a compromised program running as anon cannot get root or change the firewall.

ISO integrity

The build generates md5sum.txt and sha256sum.txt with the checksum of every file in the image, plus a .sha256 for the whole ISO. GPG signing of the ISO is still pending.