Kernel
The Linux kernel consists of a massive code base including device internals up to external interfaces. Not surprisingly that the kernel also needs attention to security principles to avoid common programming or configuration flaws. In this section the kernel is covered, from tuning it via sysctl, up to frameworks that may help improving the security of the kernel itself.
Increase kernel integrity with disabled Linux kernel modules loading
The Linux kernel can be configured to disallow loading new kernel modules. Learn how this may help and how to configure this behavior in the sysctl settings.
Kernel hardening: Disable and blacklist Linux modules
The Linux kernel provides modular support to allow loading kernel modules during runtime. To prevent security issues, learn how to disable or blacklisting.
Linux capabilities
Linux capabilities define the implementation of privileged tasks. This area collect everything related to Linux capabilities and what they do.
Linux kernel scheduler
The Linux kernel uses the Linux scheduler infrastructure to deal with tasks and assign them the right priority for processing by the CPU.
Linux kernel security and how to improve it
Every system is as strong as its weakest link, especially the system kernel. This article explains Linux kernel security, what we can do and how to do so.
Linux namespaces
The Linux kernel uses namespaces to isolate resources and make them available to one or more processes. A bit like The Matrix movie.
Overview of Linux syscalls
An overview of the available Linux syscalls, or system calls, that allows communication between user space processes and the Linux kernel.
Seccomp (secure computing)
Seccomp, or secure computing, is a security measure in the Linux kernel that allows processes to protect themselves against unexpected or unwanted behavior.
Sysctl
Learn about the sysctl command and how it can help with kernel tunables to alter the system configuration and perform additional security hardening.
Frequently Asked Questions
What is the difference between /dev/random and /dev/urandom?
The quality of random data from /dev/random is much higher than /dev/urandom, at the cost of availability of random data, especially early at the boot. Typically /dev/urandom is the preferred source to retrieve random data.
What is a tainted kernel?
The Linux kernel is marked tainted when a specific event happened that could impact reliable troubleshooting of kernel issues.
How to find the cause of a tainted Linux kernel?
Run the dmesg or journalctl command and search for 'tainted'.