From 9f73b31a56543a0a3213b33bd54561322dc7c3f7 Mon Sep 17 00:00:00 2001 From: Tommy Date: Thu, 29 Aug 2024 04:57:28 -0700 Subject: [PATCH] Update RHEL-9.sh Signed-off-by: Tommy --- RHEL-9.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/RHEL-9.sh b/RHEL-9.sh index 7e1c843..ab710eb 100644 --- a/RHEL-9.sh +++ b/RHEL-9.sh @@ -70,7 +70,8 @@ sudo chmod 644 /etc/sysctl.d/99-server.conf sudo dracut -f sudo sysctl -p -sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 console=tty0 console=ttyS0,115200' +# efi=disable_early_pci_dma seems to break boot on RHEL and only RHEL, dunno why yet +sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 console=tty0 console=ttyS0,115200' # Disable coredump unpriv curl -s https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf > /dev/null