Home / Documentation / Security
Hardening Specifications

SECURITY ARCHITECTURE.
KERNEL & RUNTIME DEFENSE.

In-depth specifications of kernel hardening configurations, runtime sysctls, Trust HAL interfaces, and device policy engines implemented in Cyronix OS.

1. Kernel Hardening Configurations

CYRONIX OS merges defensive options directly into the Linux 3.18.124-perf kernel tree via TARGET_KERNEL_ADDITIONAL_CONFIG:

  • Yama LSM: Enforces CONFIG_SECURITY_YAMA so ptrace attaches are only permitted from direct ancestor processes.
  • Software PAN: CONFIG_ARM64_SW_TTBR0_PAN prevents kernel code from directly executing or dereferencing user-space memory pointers.
  • Crash Dumps Disabled: Removed Qualcomm download-mode-on-panic to stop physical extraction of unlocked RAM dumps.
  • Symbols Removed: CONFIG_KALLSYMS_ALL stripped to prevent address leak exploitation.

2. Runtime Sysctl Hardening

Loaded on early boot via /system/etc/init/cyronix-hardening.rc: 

# Kernel pointer shielding:
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.suid_dumpable = 0
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.perf_event_paranoid = 3

# Network stack hardening:
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1

3. USB Restricted Mode Architecture

Enforced via the vendor.lineage.trust HAL interfacing with the kernel deny_new_usb sysctl. When the device screen lock engages, new USB peripheral enumeration is dropped immediately at the USB controller host interface, preventing forensic cable access.

4. Auto-Erase Device Policy

An opt-in protection implemented through Android's DevicePolicyManager.setMaximumFailedPasswordsForWipe(). A specialized CYRONIX admin service (holding only watch-login and wipe-data capabilities) monitors unlock attempts and triggers partition sanitization after 10 consecutive failures.