Skip to content

L12.4.md

Latest commit

 

History

History
33 lines (24 loc) · 1.19 KB

L12.4.md

File metadata and controls

33 lines (24 loc) · 1.19 KB

L12.4 — Kernel Hardening Techniques

Date: 2025-10-04

Author: Community Contributor (placeholder)

Estimated time

45–90 minutes

Objectives

  • Introduce practical kernel hardening techniques used to reduce attack surface.
  • Explain kernel configuration options and runtime mitigations.
  • Provide references for further reading and tools.

Prerequisites

  • Basic understanding of kernel internals and common vulnerabilities (Module 12 earlier lessons).

Content

  1. Kernel configuration options to enable hardening (e.g., KASLR, module signature enforcement, CONFIG_STRICT_DEVMEM).
  2. Runtime mitigations: SMEP/SMAP, ASLR, stack canaries, GCC hardening flags (-fstack-protector-strong).
  3. Using kernel lockdown mode and LSMs (AppArmor/SELinux) to restrict access.
  4. Minimizing attack surface: disabling unnecessary modules, careful device driver review.

Exercises

  • Audit a small kernel config and list three hardening options to enable and why.
  • Research how KASLR works and its limitations.

Further reading

  • Kernel documentation on hardening and secure boot
  • Papers on kernel attack surface reduction

Contributor notes

Create more concrete examples and config snippets as follow-ups.