19.11 Hardening

Security hardening involves additional / optional configuration and customization steps to GRUB to maximize security. The extent to which hardening can be accomplished depends on the threats attempting to be mitigated for a given system / device, the device architecture, and number of GRUB features required. The following is a listing of hardening steps which may be considered:

• (EFI Only) Enable secure boot to enable lockdown mode. This will limit the attack surface of GRUB by limiting the commands and file systems supported. (see Lockdown)
• (EFI Only) No-Execute capability of memory segments will be configured by GRUB as indicated by the UEFI. This makes some classes of vulnerabilities more difficult to exploit by providing support for marking memory as either writable or executable.
• (EFI Only) While building GRUB, the stack protector feature may be enabled during the configuration step. This feature can make certain vulnerabilities caused by stack buffer overflows more difficult to exploit. This can be enabled by including the "–enable-stack-protector" flag to the configure script:

  # ./configure --enable-stack-protector
  

  Please reference the file INSTALL for detailed instructions on how to build GRUB.

• Minimize the installed modules included with the GRUB installation. For instance, if a specific file system is used for a given system, modules for other file systems may be excluded. see Modules for a list of modules.
• Minimize boot sources. In the GRUB configuration, reduce the possible boot sources to the minimum needed for system operation. For instance, if booting only from an internal drive, remove support for network booting and booting from removable media.
• Disable network support in GRUB if not required. Ensure network interfaces are not configured in the GRUB configuration and consider setting environment variable ‘feature_net_search_cfg’ to ‘n’ in an embedded GRUB config file in order to disable attempting to use the network for obtaining a GRUB config file.