## Copyright (C) 2022 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Wiping RAM at reboot and shutdown to defeat RAM extraction attacks.
##
## RAM wipe is enabled by default on host operating systems, real hardware.
## RAM wipe is disabled by default inside virtual machines (VMs).
##
## Most users should not make any modifications to this config file because
## there is no need for that.
##
## User documentation:
## https://www.kicksecure.com/wiki/ram-wipe
##
## Design documentation:
## https://www.kicksecure.com/wiki/Dev/RAM_Wipe

## RAM wipe is omitted in virtual machines (VMs) by default because it is
## unclear if that could actually lead to the host operating system using
## swap, which means writing VM RAM contents to the disk which would be counter
## productive.

## Kernel parameter wiperam=skip is provided to support disabling RAM wipe
## at shutdown, which might be useful to speed up shutdown or in case should
## there ever be issues.
#GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT wiperam=skip"

## Duplicated in security-misc-shared:
##
## Zero memory at allocation time and free time.
## Fills newly allocated pages, freed pages, and heap objects with zeros.
## Mitigates use-after-free exploits by erasing sensitive information in memory.
##
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef
##
## KSPP=yes
## KSPP sets the kernel parameters, CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, and CONFIG_INIT_ON_FREE_DEFAULT_ON=y.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1"
