extra: restore the hardening sysctls immediately on a trapped signal

A shell defers a trapped signal until the current foreground command
finishes, and weaken-kernel-hardening held its relaxed state in a
`sleep 86400` loop. A SIGTERM therefore left kptr_restrict,
dmesg_restrict, perf_event_paranoid and unprivileged_bpf_disabled at 0
for up to a day, host-wide rather than for the testing process alone,
and SIGHUP was not trapped at all, so closing the terminal never
restored them. Run the sleep in the background with the shell blocked in
`wait`, which the signal interrupts, and add HUP to the trap list.

restore() disarms the traps before running, so the exit that follows a
signal no longer restores a second time. sudo-proc-kallsyms takes the
same trap fix for its shorter kptr_restrict window, and both scripts
record that the sysctls they touch are system-wide.

The README claimed the weakened state never outlives the process; it now
names the signals that restore and states that SIGKILL cannot be
trapped.

Author: bcoles

extra/README.md

@@ -68,8 +68,11 @@ and the same change reads as an improvement (`OK: no posture regression`).
 
 `weaken-kernel-hardening` relaxes `kptr_restrict`, `dmesg_restrict`,
 `perf_event_paranoid`, and `unprivileged_bpf_disabled` — a **testing** convenience,
-never for production. It restores the saved values on `Ctrl+C`, `SIGTERM`, or normal
-exit, so the weakened state never outlives the process.
+never for production. The sysctls are system-wide, so every process on the host
+runs unrestricted while it holds them down. It restores the saved values on
+`Ctrl+C`, `SIGTERM`, `SIGHUP`, or normal exit. `SIGKILL` cannot be trapped: a hard
+kill leaves the sysctls relaxed until they are restored by hand or the host
+reboots.
 
 `posture-diff` compares only the **boot-stable** posture — guaranteed entropy
 (virtual and physical), KASLR state, unpatched CVE-class leaks, and disabled

extra/sudo-proc-kallsyms

@@ -9,6 +9,10 @@
 # the matching kallsyms lines go to stdout. Restoration runs from a trap, so an
 # interrupted or failing read still returns kptr_restrict to its original value.
 #
+# kptr_restrict is a system-wide setting: for the few reads below, every process
+# on the host sees unhashed kernel pointers, not just this one. A SIGKILL leaves
+# it at 0 until it is set back by hand or the machine reboots.
+#
 # Requires:
 # - sudo privileges (to set kptr_restrict and read unhashed kallsyms)
 # - CONFIG_KALLSYMS=y
@@ -23,6 +27,9 @@ lowered=0
 saved_kptr=$(sysctl -n kernel.kptr_restrict 2>/dev/null) || saved_kptr=""
 
 restore() {
+  # Disarm first: the EXIT trap would otherwise restore a second time when a
+  # signal trap returns.
+  trap - INT TERM HUP EXIT
   [ "$lowered" = "1" ] || return
   if sudo sysctl -q kernel.kptr_restrict="$saved_kptr" 2>/dev/null; then
     echo "[*] kernel.kptr_restrict: 0 -> $saved_kptr (restored)" >&2
@@ -31,7 +38,7 @@ restore() {
   fi
 }
 
-trap restore INT TERM EXIT
+trap restore INT TERM HUP EXIT
 
 if [ -n "$saved_kptr" ]; then
   if sudo sysctl -q kernel.kptr_restrict=0 2>/dev/null; then

extra/weaken-kernel-hardening

@@ -2,7 +2,10 @@
 # This file is part of KASLD - https://github.com/bcoles/kasld
 #
 # Temporarily weaken kernel hardening settings for KASLD testing.
-# Saves current values and restores them on exit (or SIGINT/SIGTERM).
+# Saves current values and restores them on exit (or SIGINT/SIGTERM/SIGHUP).
+#
+# The settings are system-wide: every process on the host runs unrestricted for
+# as long as this script holds them down, not just KASLD.
 #
 # This script is intended for testing on systems you control.
 # DO NOT run this on production systems.
@@ -55,6 +58,9 @@ saved_perf=$(sysctl -n kernel.perf_event_paranoid 2>/dev/null) || saved_perf=""
 saved_bpf=$(sysctl -n kernel.unprivileged_bpf_disabled 2>/dev/null) || saved_bpf=""
 
 restore() {
+  # Disarm first: the EXIT trap would otherwise fire again on the exit below and
+  # restore a second time.
+  trap - INT TERM HUP EXIT
   echo
   echo "[*] Restoring kernel settings ..."
   [ -n "$saved_dmesg" ] && sysctl -q kernel.dmesg_restrict="$saved_dmesg"
@@ -68,7 +74,7 @@ restore() {
   exit 0
 }
 
-trap restore INT TERM EXIT
+trap restore INT TERM HUP EXIT
 
 echo "[*] Current settings:"
 [ -n "$saved_dmesg" ] && echo "  kernel.dmesg_restrict            = $saved_dmesg"
@@ -103,7 +109,12 @@ echo "[*] Hardening weakened. Run KASLD in another terminal."
 echo "[*] Press Ctrl+C to restore settings and exit."
 echo
 
-# Wait until interrupted
+# Wait until interrupted. The sleep runs in the background with the shell
+# blocked in `wait`, because a shell defers a trapped signal until the current
+# foreground command finishes: behind a day-long foreground sleep, a signal that
+# does not also reach the sleep would leave the settings weakened for the rest
+# of the day. `wait` is interrupted by the signal, so restore() runs at once.
 while true; do
-  sleep 86400
+  sleep 86400 &
+  wait "$!" || true
 done