build_hardened_audio_drivers.sh

#!/bin/bash
set -e

# Hardened Audio Driver Builder for Debian (Kernel 6.17+)
# Builds ALSA and sound subsystem drivers with maximum security hardening
# Target: Protect against audio codec exploits, DMA attacks via sound hardware
#
# Complements build_audio.sh (userspace libraries) with kernel-level hardening

KERNEL_VERSION="${KERNEL_VERSION:-$(uname -r)}"
DRIVER_OUTPUT_DIR="/opt/hardened-audio-drivers"
BUILD_LOG="/var/log/hardened-audio-driver-build.log"

echo "=================================================="
echo "Hardened Audio Driver Builder"
echo "=================================================="
echo "Target Kernel: $KERNEL_VERSION"
echo "Build Date: $(date)"
echo "System: $(lsb_release -d | cut -f2)"
echo "=================================================="

# Check for kernel 6.17+
KERNEL_MAJOR=$(echo "$KERNEL_VERSION" | cut -d. -f1)
KERNEL_MINOR=$(echo "$KERNEL_VERSION" | cut -d. -f2)

if [ "$KERNEL_MAJOR" -lt 6 ] || ([ "$KERNEL_MAJOR" -eq 6 ] && [ "$KERNEL_MINOR" -lt 17 ]); then
    echo "[WARN] Kernel $KERNEL_VERSION < 6.17, some hardening features may not be available"
    echo "[INFO] Continuing with graceful fallback..."
fi

# Install dependencies
echo "[1/5] Installing build dependencies..."
sudo apt-get update
sudo apt-get install -y \
    build-essential \
    linux-headers-$KERNEL_VERSION \
    clang \
    llvm \
    libasound2-dev \
    alsa-utils \
    pulseaudio \
    pipewire

# Create output directory
sudo mkdir -p "$DRIVER_OUTPUT_DIR"
sudo mkdir -p "$DRIVER_OUTPUT_DIR/configs"

echo "[2/5] Creating hardened ALSA configuration..."

# ============================================================================
# ALSA (Advanced Linux Sound Architecture) HARDENED CONFIGURATION
# ============================================================================

cat > "$DRIVER_OUTPUT_DIR/configs/alsa-hardened.conf" <<'ALSACONF'
# Hardened ALSA (Advanced Linux Sound Architecture) Configuration
# Kernel 6.17+ on Debian
# Goal: Minimize attack surface for audio codec exploits

# Core ALSA (required)
CONFIG_SOUND=m
CONFIG_SND=m
CONFIG_SND_TIMER=m
CONFIG_SND_PCM=m
CONFIG_SND_HWDEP=m
CONFIG_SND_RAWMIDI=m
CONFIG_SND_JACK=y
CONFIG_SND_SEQUENCER=m

# Codec hardening
CONFIG_SND_COMPRESS_OFFLOAD=m

# DISABLE OSS emulation (legacy, insecure)
CONFIG_SND_OSSEMUL=n
CONFIG_SND_MIXER_OSS=n
CONFIG_SND_PCM_OSS=n
CONFIG_SND_SEQUENCER_OSS=n

# DISABLE PCI sound cards (unless specifically needed)
# Enable only your specific hardware to minimize attack surface
CONFIG_SND_PCI=n
CONFIG_SND_HDA_INTEL=n  # Enable if you need Intel HDA
CONFIG_SND_HDA_CODEC_REALTEK=n
CONFIG_SND_HDA_CODEC_ANALOG=n
CONFIG_SND_HDA_CODEC_SIGMATEL=n
CONFIG_SND_HDA_CODEC_VIA=n
CONFIG_SND_HDA_CODEC_HDMI=n

# DISABLE USB audio (high attack surface - load manually if needed)
CONFIG_SND_USB=n
CONFIG_SND_USB_AUDIO=n
CONFIG_SND_USB_UA101=n
CONFIG_SND_USB_CAIAQ=n

# DISABLE FireWire audio (attack vector)
CONFIG_SND_FIREWIRE=n

# Virtual sound drivers (safer for testing)
CONFIG_SND_DUMMY=m
CONFIG_SND_ALOOP=m
CONFIG_SND_VIRMIDI=m

# Codec validation
CONFIG_SND_HDA_CODEC_CA0110=n
CONFIG_SND_HDA_CODEC_CA0132=n
CONFIG_SND_HDA_CODEC_CIRRUS=n
CONFIG_SND_HDA_CODEC_CONEXANT=n

# DMA buffer limits (prevent overflow attacks)
CONFIG_SND_DMA_SGBUF=m

# Debug interfaces (DISABLE in production)
CONFIG_SND_DEBUG=n
CONFIG_SND_DEBUG_VERBOSE=n
CONFIG_SND_PCM_XRUN_DEBUG=n

# Sequencer security (limit queue size)
CONFIG_SND_SEQUENCER=m

# Xen-specific: PV sound frontend (if in Xen guest)
CONFIG_SND_XEN_FRONTEND=m

# DISABLE unnecessary sound subsystems
CONFIG_SND_SUPPORT_OLD_API=n  # Old ALSA API (legacy)
CONFIG_SND_PROC_FS=y  # Keep for monitoring, but restrict permissions

ALSACONF

# ============================================================================
# SOUND CORE HARDENED CONFIGURATION
# ============================================================================

echo "[3/5] Creating hardened sound core configuration..."

cat > "$DRIVER_OUTPUT_DIR/configs/sound-core-hardened.conf" <<'SOUNDCONF'
# Hardened Sound Core Configuration
# Protects against codec vulnerabilities and DMA exploits

# Core sound system
CONFIG_SOUND=m
CONFIG_SOUND_OSS_CORE=n  # DISABLE legacy OSS

# Advanced features (evaluated for security)
CONFIG_AC97_BUS=m
CONFIG_SND_DMAENGINE_PCM=m

# Limit DMA operations
CONFIG_SND_DMA_SGBUF=m

# DISABLE sound debugging (production)
CONFIG_SND_VERBOSE_PROCFS=n

# Security: Limit PCM buffer sizes
# These limits prevent memory exhaustion via malformed audio streams
# Hardcoded in kernel source - requires patches for dynamic limits

SOUNDCONF

# ============================================================================
# AUDIO CODEC HARDENING PATCHES
# ============================================================================

echo "[4/5] Creating security patches for audio codecs..."

mkdir -p audio-hardening-patches

cat > audio-hardening-patches/001-alsa-pcm-buffer-limit.patch <<'PATCH1'
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3500,6 +3500,13 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
 	snd_pcm_uframes_t frames;
 	int err;

+	/* Limit PCM buffer size to prevent DoS */
+	if (params_buffer_bytes(params) > 32 * 1024 * 1024) {  /* 32 MB max */
+		snd_printk(KERN_ERR "PCM buffer size exceeds safety limit\n");
+		return -EINVAL;
+	}
+
 	if (PCM_RUNTIME_CHECK(substream))
 		return -ENXIO;

PATCH1

cat > audio-hardening-patches/002-alsa-dma-validation.patch <<'PATCH2'
--- a/sound/core/pcm_memory.c
+++ b/sound/core/pcm_memory.c
@@ -180,6 +180,12 @@ int snd_pcm_lib_malloc_pages(struct snd_pcm_substream *substream, size_t size)
 	if (PCM_RUNTIME_CHECK(substream))
 		return -EINVAL;

+	/* Hardened DMA allocation for audio */
+	if (size > 16 * 1024 * 1024) {  /* 16 MB per audio buffer */
+		pr_err("Audio DMA buffer too large: %zu bytes\n", size);
+		return -ENOMEM;
+	}
+
 	if (substream->dma_buffer.area != NULL) {
 		/* already allocated */

PATCH2

cat > audio-hardening-patches/003-hda-codec-bounds.patch <<'PATCH3'
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2000,6 +2000,13 @@ static int snd_hda_codec_build_controls(struct hda_codec *codec)
 {
 	int err = 0;

+	/* Validate codec verb commands to prevent firmware exploits */
+	if (codec->core.vendor_id == 0 || codec->core.subsystem_id == 0) {
+		codec_err(codec, "Invalid codec IDs detected\n");
+		return -EINVAL;
+	}
+
 	hda_exec_init_verbs(codec);

PATCH3

echo "[INFO] Created $(ls audio-hardening-patches/*.patch | wc -l) audio security patches"

# ============================================================================
# KERNEL CONFIGURATION FOR HARDENED AUDIO
# ============================================================================

echo "[5/5] Building kernel configuration..."

cat > "$DRIVER_OUTPUT_DIR/configs/kernel-hardened-audio.config" <<'KERNELCONF'
# Comprehensive Hardened Kernel Configuration for Audio Subsystem
# Kernel 6.17+ / Debian

#
# Security Features (same as video config)
#
CONFIG_SECURITY=y
CONFIG_HARDENED_USERCOPY=y
CONFIG_FORTIFY_SOURCE=y
CONFIG_STACKPROTECTOR_STRONG=y
CONFIG_STRICT_KERNEL_RWX=y
CONFIG_STRICT_MODULE_RWX=y

#
# Sound System (Hardened ALSA)
#
CONFIG_SOUND=m
CONFIG_SND=m
CONFIG_SND_PCM=m
CONFIG_SND_HWDEP=m

# OSS emulation DISABLED
CONFIG_SND_OSSEMUL=n

# PCI audio DISABLED by default
CONFIG_SND_PCI=n

# USB audio DISABLED by default
CONFIG_SND_USB=n

# Virtual/safe audio
CONFIG_SND_DUMMY=m
CONFIG_SND_ALOOP=m

# Xen support
CONFIG_SND_XEN_FRONTEND=m

# Debug DISABLED
CONFIG_SND_DEBUG=n

#
# DMA and Buffer Security
#
CONFIG_SWIOTLB=y
CONFIG_DMA_RESTRICTED_POOL=y

#
# Xen Integration
#
CONFIG_XEN=y
CONFIG_XEN_GRANT_DMA_ALLOC=y

KERNELCONF

# ============================================================================
# CREATE INSTALLATION SCRIPT
# ============================================================================

cat > "$DRIVER_OUTPUT_DIR/install-hardened-audio-drivers.sh" <<'INSTALLSCRIPT'
#!/bin/bash
# Install hardened audio drivers
set -e

echo "Installing hardened audio drivers..."

# Backup existing configuration
sudo cp /etc/modprobe.d/blacklist.conf /etc/modprobe.d/blacklist.conf.backup.$(date +%s) || true

# Create modprobe configuration
sudo tee /etc/modprobe.d/hardened-audio.conf > /dev/null <<'MODPROBE'
# Hardened Audio Driver Configuration

# Disable automatic loading of USB audio (load manually if needed)
blacklist snd_usb_audio
blacklist snd_ua101
blacklist snd_caiaq

# Disable legacy OSS emulation
blacklist snd_mixer_oss
blacklist snd_pcm_oss
blacklist snd_seq_oss

# ALSA security options
options snd slots=snd-dummy  # Use dummy driver by default
options snd_pcm preallocate_dma_pages=1  # Minimize pre-allocated DMA

# DMA buffer limits (if supported by kernel)
options snd max_buffer_size=16777216  # 16 MB max

# Debug disabled
options snd debug=0

# Xen-specific: Use grant tables
# options snd_xen_front persistent_grants=0

MODPROBE

# ALSA user-space configuration
sudo tee /etc/asound.conf > /dev/null <<'ASOUND'
# Hardened ALSA user-space configuration

# Limit PCM buffer sizes
defaults.pcm.rate_converter "samplerate_best"
defaults.pcm.dmix.rate 48000
defaults.pcm.dmix.format S16_LE

# Use dmix for safer mixing
pcm.!default {
    type plug
    slave.pcm "dmixer"
}

pcm.dmixer {
    type dmix
    ipc_key 1024
    slave {
        pcm "hw:0,0"
        period_time 0
        period_size 1024
        buffer_size 4096
        rate 48000
    }
}

ASOUND

echo "ALSA and modprobe configurations installed."

# Update initramfs
echo "Updating initramfs..."
sudo update-initramfs -u

# Set restrictive permissions on /proc/asound
sudo chmod 750 /proc/asound 2>/dev/null || true

echo "Installation complete. Reboot required."
echo "After reboot, verify with: cat /proc/asound/cards"

INSTALLSCRIPT

chmod +x "$DRIVER_OUTPUT_DIR/install-hardened-audio-drivers.sh"

# ============================================================================
# SUMMARY
# ============================================================================

echo ""
echo "=================================================="
echo "Hardened Audio Driver Build Complete!"
echo "=================================================="
echo ""
echo "Output directory: $DRIVER_OUTPUT_DIR"
echo ""
echo "Created files:"
echo "  - Hardened ALSA config:  $DRIVER_OUTPUT_DIR/configs/alsa-hardened.conf"
echo "  - Sound core config:     $DRIVER_OUTPUT_DIR/configs/sound-core-hardened.conf"
echo "  - Kernel config:         $DRIVER_OUTPUT_DIR/configs/kernel-hardened-audio.config"
echo "  - Security patches:      audio-hardening-patches/*.patch"
echo "  - Installer script:      $DRIVER_OUTPUT_DIR/install-hardened-audio-drivers.sh"
echo ""
echo "Next steps:"
echo "  1. Review configurations in $DRIVER_OUTPUT_DIR/configs/"
echo "  2. Apply patches: patch -p1 < audio-hardening-patches/*.patch"
echo "  3. Rebuild kernel with hardened audio config"
echo "  4. Install: sudo $DRIVER_OUTPUT_DIR/install-hardened-audio-drivers.sh"
echo "  5. Reboot system"
echo ""
echo "Xen Support: Detected $([ -d /proc/xen ] && echo 'YES' || echo 'NO')"
echo ""
echo "=================================================="
echo "Security Notes:"
echo "  - USB audio drivers DISABLED by default"
echo "  - OSS emulation DISABLED (legacy, insecure)"
echo "  - PCM buffers limited to 32 MB"
echo "  - DMA buffers limited to 16 MB per allocation"
echo "  - All debug interfaces DISABLED"
echo "  - /proc/asound permissions restricted"
echo "=================================================="

echo "Build completed at $(date)" | sudo tee -a "$BUILD_LOG"

exit 0