---
-edit_link: ''
title: Memory
-origin_url: >-
- https://raw.githubusercontent.com/automotive-grade-linux/docs-sources/master/docs/security-blueprint/part-4/2-Memory.md
---
-<!-- WARNING: This file is generated by fetch_docs.js using /home/boron/Documents/AGL/docs-webtemplate/site/_data/tocs/architecture/master/security_blueprint-security-blueprint-book.yml -->
-
# Memory
## Restrict access to kernel memory
-The /dev/kmem file in Linux systems is directly mapped to kernel virtual memory. This can be disastrous if an attacker gains root access, as the attacker would have direct access to kernel virtual memory.
+The /dev/kmem file in Linux systems is directly mapped to kernel virtual memory.
+This can be disastrous if an attacker gains root access, as the attacker would
+have direct access to kernel virtual memory.
-To disable the /dev/kmem file, which is very infrequently used by applications, the following kernel option should be set in the compile-time kernel configuration:
+To disable the /dev/kmem file, which is very infrequently used by applications,
+the following kernel option should be set in the compile-time kernel
+configuration:
<!-- section-config -->
<!-- end-section-config -->
-In case applications in userspace need /dev/kmem support, it should be available only for authenticated applications.
+In case applications in userspace need /dev/kmem support, it should be available
+only for authenticated applications.
--------------------------------------------------------------------------------
## Disable access to a kernel core dump
-This kernel configuration disables access to a kernel core dump from user space. If enabled, it gives attackers a useful view into kernel memory.
+This kernel configuration disables access to a kernel core dump from user space.
+If enabled, it gives attackers a useful view into kernel memory.
<!-- section-config -->
## Disable swap
-If not disabled, attackers can enable swap at runtime, add pressure to the memory subsystem and then scour the pages written to swap for useful information.
+If not disabled, attackers can enable swap at runtime, add pressure to the
+memory subsystem and then scour the pages written to swap for useful
+information.
<!-- section-config -->
## Disable "Load All Symbols"
-There is a /proc/kallsyms file which exposes the kernel memory space address of many kernel symbols (functions, variables, etc...). This information is useful to attackers in identifying kernel versions/configurations and in preparing payloads for the exploits of kernel space.
+There is a /proc/kallsyms file which exposes the kernel memory space address of
+many kernel symbols (functions, variables, etc...). This information is useful
+to attackers in identifying kernel versions/configurations and in preparing
+payloads for the exploits of kernel space.
Both `KALLSYMS_ALL` and `KALLSYMS` shall be disabled;
## Stack protection
-To prevent stack-smashing, similar to the stack protector used for ELF programs in user-space, the kernel can protect its internal stacks as well.
+To prevent stack-smashing, similar to the stack protector used for ELF programs
+in user-space, the kernel can protect its internal stacks as well.
-This configuration is supported in **Linux 3.11 and greater** and thus should only be enabled for such versions.
+This configuration is supported in **Linux 3.11 and greater** and thus should
+only be enabled for such versions.
-This configuration also requires building the kernel with the **gcc compiler 4.2 or greater**.
+This configuration also requires building the kernel with the **gcc compiler 4.2
+or greater**.
<!-- section-config -->
## Disable access to /dev/mem
-The /dev/mem file in Linux systems is directly mapped to physical memory. This can be disastrous if an attacker gains root access, as the attacker would have direct access to physical memory through this convenient device file. It may not always be possible to disable such file, as some applications might need such support. In that case, then this device file should be available only for authenticated applications.
+The /dev/mem file in Linux systems is directly mapped to physical memory. This
+can be disastrous if an attacker gains root access, as the attacker would have
+direct access to physical memory through this convenient device file. It may not
+always be possible to disable such file, as some applications might need such
+support. In that case, then this device file should be available only for
+authenticated applications.
-This configuration is supported in **Linux 4.0 and greater** and thus should only be disabled for such versions.
+This configuration is supported in **Linux 4.0 and greater** and thus should
+only be disabled for such versions.
<!-- section-config -->
## Disable cross-memory attach
-Disable the process_vm_*v syscalls which allow one process to peek/poke the virtual memory of another.
+Disable the process_vm_*v syscalls which allow one process to peek/poke the
+virtual memory of another.
-This configuration is supported in **Linux 3.5 and greater** and thus should only be disabled for such versions.
+This configuration is supported in **Linux 3.5 and greater** and thus should
+only be disabled for such versions.
<!-- section-config -->
Code Review / AGL / documentation.git / blobdiff