{"id":174,"date":"2008-11-21T13:39:56","date_gmt":"2008-11-21T21:39:56","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=174"},"modified":"2008-11-21T13:40:15","modified_gmt":"2008-11-21T21:40:15","slug":"make-your-bios-love-security","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2008\/11\/21\/make-your-bios-love-security\/","title":{"rendered":"make your BIOS love security"},"content":{"rendered":"

There’s this great CPU feature called “nx<\/a>” — it protects your computer from intrusion by blocking execution of memory regions that weren’t expected to be executable (i.e. stack\/heap data). You really want this enabled. Unfortunately for you, it seems some BIOSes default to disabling it. On Dell laptops, look under “Security” \/ “CPU XD Support”: you want it enabled. In an American Megatrends BIOS, I found it under “CPU Features” \/ “Execute Disable Bit”: you want it enabled.<\/p>\n

As far as making use of the CPU feature once it’s not disabled in the BIOS, you’re already using it if you’re running a 64bit kernel. And if you’re using 32bit, you can start using it if you install the -server<\/code> flavor of the 32bit kernel. As a bonus, you get to address all your physical RAM<\/a> if you do this too (since -server’s “PAE<\/a>” mode is the kernel mode that allows “nx” to work). For Ubuntu Jaunty, I’m hoping to get some element of the system (installer? jockey?) to make the right kernel selection<\/a> for a given system.<\/p>\n

If “pae” is in your \/proc\/cpuinfo flags:
\n<\/p>\n

\r\n$ grep --color pae \/proc\/cpuinfo\r\nflags\t\t: fpu vme de pse tsc msr pae<\/strong> mce cx8 apic sep mtrr pge mca cmov \\\r\npat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx<\/em> lm constant_tsc \\\r\narch_perfmon pebs bts rep_good nopl pni monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr lahf_lm\r\n<\/pre>\n
<\/code>(note the “nx” in there too, since my BIOS isn’t set to disable it)<\/p>\n
Then you almost certainly want to use -server<\/code> kernel flavor:
\n<\/p>\n
\r\nsudo apt-get install linux-server linux-restricted-modules-server\r\n<\/pre>\n
<\/code><\/p>\n
© 2008, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"
There’s this great CPU feature called “nx” — it protects your computer from intrusion by blocking execution of memory regions that weren’t expected to be executable (i.e. stack\/heap data). You really want this enabled. Unfortunately for you, it seems some BIOSes default to disabling it. On Dell laptops, look under “Security” \/ “CPU XD Support”: […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/174"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=174"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/174\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}