Azure Linux includes a comprehensive set of security features enabled by default to protect against various attack vectors.
Networking
| Feature | Status | Description |
|---|
| Configurable Firewall | By default | iptables for packet filtering |
| SYN cookies | By default | CONFIG_SYN_COOKIES=y protects against SYN flood attacks |
Updates
| Feature | Status | Description |
|---|
| Signed updates | By default | Package signatures verified via tdnf and dnf |
Always verify package signatures when installing software. Unsigned packages may have been tampered with or come from untrusted sources.
Build Options
All binaries in Azure Linux are built with hardening flags enabled by default:
| Feature | Status | Description |
|---|
| Position Independent Executable (PIE) | By default | -fPIE, -pie enables ASLR for executables |
| Stack Protector Strong | By default | -fstack-protector-strong detects stack buffer overflows |
| Format Security | By default | -Wformat-security validates format strings |
| Fortify Source | By default | _FORTIFY_SOURCE adds buffer overflow checks |
| Bind Now | By default | —enable-bind-now resolves all symbols at load time |
| RELRO | By default | relro makes segments read-only after relocation |
Address Space Layout Randomization (ASLR)
ASLR randomizes memory addresses to make exploitation more difficult:
| Feature | Status | Description |
|---|
| Stack ASLR | By default | Available since kernel 2.6.15 |
| Libs/mmap ASLR | By default | Available since kernel 2.6.15 |
| Exec ASLR | By default | Available since kernel 2.6.25 |
| brk ASLR | By default | Available since kernel 2.6.22 |
| VDSO ASLR | By default | Available for x86_64 since kernel 2.6.22 |
Kernel Hardening
Azure Linux includes extensive kernel hardening features:
| Feature | Status | Description |
|---|
| /proc/$pid/maps protection | By default | Enabled by default since kernel 2.6.27 |
| Symlink restrictions | By default | fs.protected_symlinks prevents symlink attacks |
| Hardlink restrictions | By default | fs.protected_hardlinks prevents hardlink attacks |
| 0-address protection | By default | vm.mmap_min_addr prevents NULL pointer dereference exploits |
| Kernel Address Display Restriction | By default | kernel.kptr_restrict hides kernel addresses |
| Block module loading | Available | kernel.modules_disabled |
| /dev/mem protection | By default | CONFIG_STRICT_DEVMEM=y |
| /dev/kmem disabled | By default | CONFIG_DEVKMEM=n |
| Kernel Module RO/NX | By default | CONFIG_STRICT_MODULE_RWX=y |
| Write-protect kernel .rodata sections | By default | CONFIG_STRICT_KERNEL_RWX=y |
| Kernel Stack Protector | By default | CONFIG_STACKPROTECTOR=y |
The kernel.modules_disabled sysctl permanently disables module loading until reboot. Only enable this after all required modules are loaded.
GCC/glibc Hardening
| Feature | Status | Description |
|---|
| Overflow checking in new operator | By default | gcc integer overflow protection |
| Pointer Obfuscation | By default | glibc pointer encryption protects function pointers |
| Heap Consistency Checking | By default | glibc Heap Consistency Checking detects heap corruption |
System Call Filtering
| Feature | Status | Description |
|---|
| Syscall Filtering (seccomp) | Available | CONFIG_SECCOMP_FILTER=y allows syscall filtering |
| Seccomp sandbox | Available | PR_SET_SECCOMP |
Process Isolation
| Feature | Status | Description |
|---|
| Ptrace Mitigation | Available | Yama LSM restricts ptrace |
| User namespaces | Available | CONFIG_USER_NS=y |
| Private /tmp for systemd services | Available | PrivateTmp |
| Polyinstantiate /tmp, /var/tmp, and user home folders | Available | namespace.conf |
| Mandatory access control | By default | SELinux enforces access policies |
Encrypted Storage
| Feature | Status | Description |
|---|
| Encrypted Volumes | Available | Encrypt volumes during OS installation |
Encrypted storage is configured during installation. Enabling encryption on existing systems requires data migration.
Miscellaneous
| Feature | Status | Description |
|---|
| Password hashing | By default | SHA-512 algorithm for secure password storage |
| Filesystem Capabilities | Available | Capabilities and chattr |
| Tamper Resistant Logs | Available | journalctl —verify validates log integrity |
| Kernel Lockdown | Integrity mode by default | kernel lockdown restricts kernel modification |
References