• 13 Posts
  • 188 Comments
Joined 10 months ago
cake
Cake day: July 13th, 2024

help-circle




  • The installation was a bit scary but not too bad.

    i feel the same way since i never built my system from scratch before (i was a linux mint user, so a lil bit spoiled lol).

    Then I was greeted by an HDD boot speed comparable to my gaming PC with an NVMe. I still miss that now when the PC is running Arch (btw).

    that’s wild! i was shocked when my old 32 bit laptop became usable again after installing void there.

    When it comes to issues, I only remember a missing screenshot utility (fixed with 1 command) and fonts (can’t remember if I ended up fixing it).

    which screenshot app did you end up using?




  • void already comes with a pretty solid, hardened kernel setup by default. some of the security features it has out of the box include full ASLR, NX protection, protected symlinks and hardlinks, randomization for kernel heap and SLAB freelists, stack protection with GCC, and a bunch of other things like restricting access to /dev/mem, enforcing read-only kernel and module data, and more. the default bootloader setup also includes things like slub_debug, page_poison, and secure memory allocation. but the default void settings aren’t hardened at 100%, because otherwise you would be using OpenBSD lol.

    there’s also a script called hardening.sh in the void-packages repo. i’ve seen some folks trying to bring Whonix-style features (i think its name is PlagueOS) or grsecurity/PaX-like standards to Void too, but that’s a pretty big undertaking.

    this is the output of checksec --kernel on my machine

     checksec --kernel
    * Kernel protection information:
    
      Description - List the status of kernel protection mechanisms. Rather than
      inspect kernel mechanisms that may aid in the prevention of exploitation of
      userspace processes, this option lists the status of kernel configuration
      options that harden the kernel itself against attack.
    
      Kernel config:
    /proc/config.gz
    
      Vanilla Kernel ASLR:                    Full
      NX protection:                          Skipped
      Protected symlinks:                     Enabled
      Protected hardlinks:                    Enabled
      Protected fifos:                        Disabled
      Protected regular:                      Disabled
      Ipv4 reverse path filtering:            Disabled
      Kernel heap randomization:              Enabled
      GCC stack protector support:            Enabled
      GCC stack protector strong:             Enabled
      SLAB freelist randomization:            Enabled
      Virtually-mapped kernel stack:          Enabled
      Restrict /dev/mem access:               Enabled
      Restrict I/O access to /dev/mem:        Enabled
      Exec Shield:                            Unsupported
      YAMA:                                   Active
    
      Hardened Usercopy:                      Enabled
      Harden str/mem functions:               Enabled
    
    * X86 only:
      Address space layout randomization:     Enabled
    
    * SELinux:                                No SELinux
    
      SELinux infomation available here:
        http://selinuxproject.org/