From 32ecdb4e8ccccf07acd8c6c82a3676ec15647b4a Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 16 Feb 2022 14:02:45 +0100 Subject: [PATCH 1/3] add grub2 variant --- .../rule.yml | 40 +++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml diff --git a/linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml new file mode 100644 index 00000000000..3d0c8b95d8a --- /dev/null +++ b/linux_os/guide/system/bootloader-grub2/grub2_page_alloc_shuffle_argument/rule.yml @@ -0,0 +1,40 @@ +documentation_complete: true + +prodtype: rhel9 + +title: 'Enable randomization of the page allocator' + +description: |- + To enable randomization of the page allocator in the kernel, add the + page_alloc.shuffle=1 argument to the default GRUB 2 command line. + {{{ describe_grub2_argument("page_alloc.shuffle=1") | indent(4) }}} + +rationale: |- + The CONFIG_SHUFFLE_PAGE_ALLOCATOR config option is primarily + focused on improving the average utilization of a direct-mapped + memory-side-cache. Aside of this performance effect, it also reduces + predictability of page allocations in situations when the bad actor can + crash the system and somehow leverage knowledge of (page) allocation order + right after a fresh reboot, or can control the timing between a + hot-pluggable memory node (as in NUMA node) and applications allocating + memory ouf of that node. The page_alloc.shuffle=1 kernel command + line parameter then forces this functionality irrespectively of memory cache + architecture. + +severity: medium + +identifiers: + cce@rhel9: CCE-85879-5 + +ocil_clause: 'randomization of the page allocator is not enabled in the kernel' + +ocil: |- + {{{ ocil_grub2_argument("page_alloc.shuffle=1") | indent(4) }}} + +platform: machine + +template: + name: grub2_bootloader_argument + vars: + arg_name: page_alloc.shuffle + arg_value: '1' From ccd4bee3bec201cdee883c662056fc408b2d88ad Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 16 Feb 2022 14:20:59 +0100 Subject: [PATCH 2/3] add zipl variant --- .../zipl_page_alloc_shuffle_argument/rule.yml | 46 +++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml new file mode 100644 index 00000000000..5179b19fcc0 --- /dev/null +++ b/linux_os/guide/system/bootloader-zipl/zipl_page_alloc_shuffle_argument/rule.yml @@ -0,0 +1,46 @@ +documentation_complete: true + +prodtype: rhel9 + +title: 'Enable randomization of the page allocator in zIPL' + +description: |- + To enable the randomization of the page allocator in the kernel, check that + all boot entries in /boot/loader/entries/*.conf have + page_alloc.shuffle=1 included in its options.
+ + To enable randomization of the page allocator also for newly installed + kernels, add page_alloc.shuffle=1 to /etc/kernel/cmdline. + +rationale: |- + The CONFIG_SHUFFLE_PAGE_ALLOCATOR config option is primarily + focused on improving the average utilization of a direct-mapped + memory-side-cache. Aside of this performance effect, it also reduces + predictability of page allocations in situations when the bad actor can + crash the system and somehow leverage knowledge of (page) allocation order + right after a fresh reboot, or can control the timing between a + hot-pluggable memory node (as in NUMA node) and applications allocating + memory ouf of that node. The page_alloc.shuffle=1 kernel command + line parameter then forces this functionality irrespectively of memory cache + architecture. + +severity: medium + +identifiers: + cce@rhel9: CCE-85880-3 + +ocil_clause: 'randomization of the page allocator is not enabled in the kernel' + +ocil: |- + To check that the randomization of the page allocator in the kernel is + enabled, check all boot entries with following command: + 
sudo grep -L"^options\s+.*\bpage_alloc\.shuffle=1\b" /boot/loader/entries/*.conf
+ No line should be returned, each line returned is a boot entry that doesn't enable audit. + +platform: machine + +template: + name: zipl_bls_entries_option + vars: + arg_name: page_alloc.shuffle + arg_value: '1' From 89671b0a5a69ccaf0a46ff1fc86db82fc822dda0 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 16 Feb 2022 14:24:32 +0100 Subject: [PATCH 3/3] add rules to rhel9 ospp profile --- products/rhel9/profiles/ospp.profile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile index f25abd7e4c4..4bdf8d98b97 100644 --- a/products/rhel9/profiles/ospp.profile +++ b/products/rhel9/profiles/ospp.profile @@ -126,6 +126,7 @@ selections: - grub2_audit_backlog_limit_argument - grub2_vsyscall_argument - grub2_init_on_alloc_argument + - grub2_page_alloc_shuffle_argument ## Security Settings - sysctl_kernel_kptr_restrict @@ -409,3 +410,4 @@ selections: - zipl_audit_backlog_limit_argument - zipl_vsyscall_argument - zipl_init_on_alloc_argument + - zipl_page_alloc_shuffle_argument