{"id":20677630,"url":"https://github.com/kicksecure/hardened-kernel","last_synced_at":"2025-04-19T20:58:05.620Z","repository":{"id":50037057,"uuid":"220771607","full_name":"Kicksecure/hardened-kernel","owner":"Kicksecure","description":"Hardened kernel configuration optimized for virtual machines. - https://www.kicksecure.com/wiki/Hardened-kernel","archived":false,"fork":false,"pushed_at":"2025-01-23T16:20:38.000Z","size":1029,"stargazers_count":44,"open_issues_count":2,"forks_count":9,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-03-29T13:22:49.169Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://www.kicksecure.com/wiki/imprint","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Kicksecure.png","metadata":{"files":{"readme":"README.md","changelog":"changelog.upstream","contributing":"CONTRIBUTING.md","funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-11-10T10:03:25.000Z","updated_at":"2025-03-12T07:02:25.000Z","dependencies_parsed_at":"2023-11-11T21:23:32.274Z","dependency_job_id":"48718ac6-926a-413d-a586-c4e615c93cb6","html_url":"https://github.com/Kicksecure/hardened-kernel","commit_stats":null,"previous_names":[],"tags_count":46,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fhardened-kernel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fhardened-kernel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fhardened-kernel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fhardened-kernel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kicksecure","download_url":"https://codeload.github.com/Kicksecure/hardened-kernel/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249800270,"owners_count":21327031,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-16T21:16:33.927Z","updated_at":"2025-04-19T20:58:05.595Z","avatar_url":"https://github.com/Kicksecure.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Hardened Kernel for Host and VMs #\n\nThis is a hardened kernel configuration for Whonix / Kicksecure.\nhardened-vm-kernel is designed specifically for virtual machines and\nhardened-host-kernel is designed for hosts.\n\nBoth configs try to have as many hardening options enabled as possible and\nhave little attack surface. hardened-vm-kernel only has support for VMs\nand all other hardware options are disabled to reduce attack surface and\ncompile time.\n\nDuring installation of hardened-vm-kernel, it compiles the kernel on your own\nmachine and does not use a pre-compiled kernel. This ensures the kernel\nsymbols in the compiled image are completely unique which makes it far harder\nfor kernel exploits. This is possible due to hardened-vm-kernel having only VM\nconfig options enabled which drastically reduces compile time.\n\nDuring installation of hardened-host-kernel, the kernel is not compiled on\nyour machine and it uses a pre-compiled kernel. This is because the host\nkernel needs most hardware options enabled to support most devices which makes\ncompilation take a very long time.\n\nThe VM kernel is more secure than the host kernel due to having less attack\nsurface and not being pre-compiled but if you want more security for the host,\nit is recommended to edit the hardened host config, enable only the hardware\noptions you need and compile the kernel yourself. This makes the security of\nthe host and VM kernel comparable.\n\nBoth configs were based on the default Debian config.\n\nThese kernels use the linux-hardened patch for further hardening. Custom\nhardening patches should be\nsent there.\n\nThis only supports LTS kernels as they have the least attack surface (stable\nkernels have more code and more bugs) and the best stability.\n\nBuild script /usr/share/hardened-vm-kernel/build does not run automatic yet.\n\nKernel does not get installed automatic yet.\n\nSee also development discussion:\nhttp://forums.whonix.org/t/kernel-recompilation-for-better-hardening\n\n## How to install `hardened-kernel` using apt-get ##\n\n1\\. Download the APT Signing Key.\n\n```\nwget https://www.kicksecure.com/keys/derivative.asc\n```\n\nUsers can [check the Signing Key](https://www.kicksecure.com/wiki/Signing_Key) for better security.\n\n2\\. Add the APT Signing Key.\n\n```\nsudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc\n```\n\n3\\. Add the derivative repository.\n\n```\necho \"deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free\" | sudo tee /etc/apt/sources.list.d/derivative.list\n```\n\n4\\. Update your package lists.\n\n```\nsudo apt-get update\n```\n\n5\\. Install `hardened-kernel`.\n\n```\nsudo apt-get install hardened-kernel\n```\n\n## How to Build deb Package from Source Code ##\n\nCan be build using standard Debian package build tools such as:\n\n```\ndpkg-buildpackage -b\n```\n\nSee instructions.\n\nNOTE: Replace `generic-package` with the actual name of this package `hardened-kernel`.\n\n* **A)** [easy](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package/easy), _OR_\n* **B)** [including verifying software signatures](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package)\n\n## Contact ##\n\n* [Free Forum Support](https://forums.kicksecure.com)\n* [Premium Support](https://www.kicksecure.com/wiki/Premium_Support)\n\n## Donate ##\n\n`hardened-kernel` requires [donations](https://www.kicksecure.com/wiki/Donate) to stay alive!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkicksecure%2Fhardened-kernel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkicksecure%2Fhardened-kernel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkicksecure%2Fhardened-kernel/lists"}