Skip to content

Prevent runaway privileged processes from writing to block devices bdev_allow_write_mounted=0 #334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adrelanos merged 1 commit into from
Dec 3, 2025
Merged

Prevent runaway privileged processes from writing to block devices bdev_allow_write_mounted=0 #334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,9 @@ Kernel space:
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
and other persistent data to either the UEFI variable storage or ACPI ERST backends.

- Prevent runaway privileged processes from writing to block devices that are mounted by
filesystems to protect against filesystem corruption and kernel crashes.

Direct memory access:

- Enable strict IOMMU translation to protect against some DMA attacks via the use
Expand Down
12 changes: 12 additions & 0 deletions etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,18 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"

## Prevent processes from writing to block devices that are mounted by filesystems.
## Enhances system stability and security by protecting against runaway privileged processes.
## Allowing processes to write to the buffer cache can cause filesystem corruption and kernel crashes.
## Does not prevent data modifications using direct SCSI commands or lower-level storage stack access.
## May lead to breakages in certain limited scenarios.
##
## https://github.com/torvalds/linux/commit/ed5cc702d311c14b653323d76062b0294effa66e
## https://lore.kernel.org/lkml/20240105-vfs-super-4092d802972c@brauner/
## https://github.com/a13xp0p0v/kernel-hardening-checker/issues/186
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX bdev_allow_write_mounted=0"

## 2. Direct Memory Access:
##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks
Expand Down