Add vm.max_map_count = 1048576 to /etc/sysctl.conf to accommodate
- hardened_malloc's large amount of guard pages.
Add the following to /etc/sysctl.conf or a configuration file within
+ /etc/sysctl.d/to accommodate hardened_malloc's large amount of guard pages:
vm.max_map_count = 1048576
$ git clone https://github.com/GrapheneOS/hardened_malloc.git
$ git clone https://github.com/GrapheneOS/hardened_malloc.git
$ cd hardened_malloc/
$ cd hardened_malloc/
$ make <arguments>
$ make <arguments>
CONFIG_N_ARENA=n can be adjusted to increase parallel performance at the
expense of memory usage, or decrease memory usage at the expense of parallel performance, where
n is a non-negative integer. Higher values prefer parallel performance,
whereas lower values prefer lower memory usage. Note that having too many arenas may cause memory
fragmentation and decrease system performance. The number of arenas has no impact on the security
properties of hardened_malloc.
| Minimum | -Maximum | -Default | -
|---|---|---|
| 1 | -256 | -4 | -
| Minimum | +Maximum | +Default | +
|---|---|---|
| 1 | +256 | +4 | +
For extra security, CONFIG_SEAL_METADATA=true can be used in order to control
whether
Memory Protection Keys
@@ -108,23 +109,26 @@
current-generation hardware. Whether or not this feature is enabled, the metadata is all contained
within an isolated memory region with high-entropy random guard regions around it.
For low-memory systems, VARIANT=light can be used to compile the light variant of
- hardened_malloc, which sacrifices some security for much less memory usage. This option still
- produces a more hardened memory allocator than both the default musl and glibc allocators, despite
- the security sacrifices over the full variant.
For all compile-time options, see the configuration section of hardened_malloc's official documentation.
# cp out/libhardened_malloc.so /usr/local/lib/libhardened_malloc.so
# cp out/libhardened_malloc.so /usr/local/lib/libhardened_malloc.so
musl-based systems: Add LD_PRELOAD=/usr/local/lib/libhardened_malloc.so to
- /etc/environment
glibc-based systems: Add /usr/local/lib/libhardened_malloc.so to
- /etc/ld.so.preload
In order to preload the hardened_malloc shared library on boot, perform the following + actions:
+musl-based systems: Add the following to /etc/environment or a configuration
+ file within /etc/environment.d/:
LD_PRELOAD=/usr/local/lib/libhardened_malloc.so+
glibc-based systems: Add the following to /etc/ld.so.preload:
/usr/local/lib/libhardened_malloc.so