경우에 따라 사용자가 직접 운영체제를 빌드하거나 커스텀 커널을 컴파일해야 할 수 있습니다. 커스텀 커널을 컴파일하거나 VM의 커스텀 운영체제를 만드는 경우 이 문서의 요구사항을 충족하는지 확인하세요.
커스텀 운영체제 빌드는 특별히 커스텀 커널이 필요한 애플리케이션 사용자를 위한 고급 작업입니다. 대부분 사용자는 사용 가능한 공개 이미지 중 하나로 VM을 만들거나, 자동 가상 디스크 가져오기 도구를 사용하여 다른 환경에서 Compute Engine으로 디스크를 가져오거나, 일반 스톡 Linux 배포판을 사용하는 시스템에서 수동으로 커스텀 이미지를 가져옵니다.
하드웨어 지원 요구사항
커널에서 다음 기기를 지원해야 합니다.
PCI 브리지: Intel Corporation 82371AB/EB/MB PIIX4 ACPI(수정 번호 03)
PCI 공간, BIOS 코드, 데이터 리전에만 액세스 할 수 있도록 /dev/mem을 제한합니다.
CONFIG_DEVKMEM=n
/dev/kmem 지원을 사용 중지합니다.
커널 메모리에 대한 액세스를 차단합니다.
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
사용자 공간 할당으로부터 보호되는 낮은 가상 메모리를 설정합니다.
CONFIG_DEBUG_RODATA=y
커널 읽기 전용 데이터를 페이지 테이블의 쓰기 금지로 표시하여 실수로 해당 const 데이터에 대한 (잘못된) 쓰기를 포착합니다. 이 옵션은 2MB TLB가 커널 코드의 일부를 더 이상 처리하지 않기 때문에 성능에 약간의 영향을 줄 수 있습니다.
CONFIG_DEBUG_SET_MODULE_RONX=y
로드 가능한 커널 모듈의 텍스트와 읽기 전용 데이터에 대한 의도하지 않은 수정 사항을 포착합니다. 이 옵션은 모듈 데이터의 실행도 방지합니다.
CONFIG_CC_STACKPROTECTOR=y
-fstack-protector GCC 기능을 사용 설정합니다. 이 기능은 중요한 기능의 시작 부분에서 반환 주소 앞의 스택에 카나리아 값을 넣고 실제로 반환하기 전에 값을 검사합니다. 이로 인해 이 반환 주소를 덮어써야 하는 스택 기반 버퍼 오버플로가 카나리아를 덮어쓰게 됩니다. 이는 감지되고 커널 패틱으로 중화됩니다.
CONFIG_COMPAT_VDSO=n
ASLR 강화를 위해 VDSO가 예측 가능한 주소에 있지 않도록 합니다. 이 기능을 사용하면 VDSO를 예측 가능한 이전 주소로 매핑하여 악용 코드가 이동할 예상 위치를 제공합니다.
여기에서는 고도로 매핑된 VDSO 매핑을 제거하고 임의 VDSO를 단독으로 사용하기 위해 충분히 최신 glibc 버전(2.3.3 이상)을 실행하고 있는 경우 N이라고 하겠습니다.
CONFIG_COMPAT_BRK=n
힙 임의화를 중지하지 않습니다.
CONFIG_X86_PAE=y
NX 지원에 PAE가 필요하므로 32비트 커널에 이 옵션을 설정합니다.
이는 또한 오버커밋이 아닌 용도에 큰 스왑 공간 지원을 사용 설정합니다.
CONFIG_SYN_COOKIES=y
SYN 범람으로부터 보호합니다.
CONFIG_SECURITY_YAMA=y
이는 일반 Linux 임의 액세스 제어를 넘어 시스템 전반의 보안 설정으로 DAC 지원을 확장하는 Yama를 선택합니다.
현재 설정은 ptrace 범위 제한입니다.
CONFIG_SECURITY_YAMA_STACKED=y
이 옵션은 Yama를 사용할 수 있을 때 Yama를 선택한 기본 LSM과 함께 배치하게 합니다.
커널 보안 설정
커널 설정 파일을 통해 커널의 보안을 강화할 수도 있습니다. /etc/sysctl.conf 파일을 수정하여 다음 추천 보안 설정을 포함합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-03-12(UTC)"],[[["\u003cp\u003eBuilding custom operating systems or compiling custom kernels is an advanced task mainly for applications with specific kernel requirements, with most users able to use public images or import existing ones.\u003c/p\u003e\n"],["\u003cp\u003eCustom kernels must support specific hardware devices including PCI Bridge, ISA bridge, Virtio-Net or gVNIC Ethernet controller, Virtio-SCSI storage controller (or NVMe for newer machine series), and four 16550A serial ports.\u003c/p\u003e\n"],["\u003cp\u003eRequired Linux kernel build options include enabling paravirtualization, PCI devices, disks, and networking, as well as enabling high-performance interrupt delivery, which is needed for local SSD devices.\u003c/p\u003e\n"],["\u003cp\u003eRecommended kernel security settings involve restricting \u003ccode\u003e/dev/mem\u003c/code\u003e, disabling \u003ccode\u003e/dev/kmem\u003c/code\u003e, setting low virtual memory protection, using read-only protection for kernel data, enabling stack protection, and randomizing memory addresses.\u003c/p\u003e\n"],["\u003cp\u003eKernel security can also be hardened by editing \u003ccode\u003e/etc/sysctl.conf\u003c/code\u003e to include settings for syn flood protection, ignoring source-routed packets and ICMP redirects, preventing traffic routing, enabling reverse path filtering, and randomizing addresses.\u003c/p\u003e\n"]]],[],null,["# Requirements to build custom images\n\nLinux\n\n*** ** * ** ***\n\nIn some situations, your applications might require you to build your own\noperating system or compile a custom kernel. If you compile custom kernels or\ncreate custom operating systems for your VMs, ensure that they meet the\nrequirements in this document.\n\n[Building a custom operating system](/compute/docs/images/create-custom) is an\nadvanced task for users with applications that specifically require a custom\nkernel. Most users can create VMs from one of the available\n[public images](/compute/docs/images#os-compute-support), use the automated\n[virtual disk import tool](/compute/docs/import/importing-virtual-disks) to\nimport disks into Compute Engine from other environments, or\n[manually import a custom image](/compute/docs/import/import-existing-image)\nfrom a system with a common stock Linux distribution.\n\nHardware support requirements\n-----------------------------\n\nYour kernel must support the following devices:\n\n- PCI Bridge: Intel Corporation 82371AB/EB/MB PIIX4 ACPI (rev 03)\n- ISA bridge: Intel 82371AB/EB/MB PIIX4 ISA (rev 03)\n- Ethernet controller:\n\n - Virtio-Net Ethernet Adapter.\n - gVNIC is required for second generation\n [Tau T2A](/compute/docs/general-purpose-machines#t2a_machines),\n and all third generation and later machine series.\n\n Additionally, gVNIC is required or recommended if you use GPUs on any of\n the following:\n - General-purpose N1 machine types\n - Accelerator-optimized [A4](/compute/docs/accelerator-optimized-machines#a4-vms), [A3](/compute/docs/accelerator-optimized-machines#a3-vms), [A2](/compute/docs/accelerator-optimized-machines#a2-vms), or [G2](/compute/docs/accelerator-optimized-machines#g2-vms) machine types\n - vendor = 0x1AF4 (Qumranet/Red Hat)\n\n - device id = 0x1000. Subsystem ID 0x1\n\n - Checksum offload is supported\n\n - TSO v4 is supported\n\n - GRO v4 is supported\n\n- SCSI Storage Controller:\n\n - Virtio-SCSI Storage Controller\n - vendor = 0x1AF4 (Qumranet/Red Hat)\n - device id = 0x1004. Subsystem ID 0x8.\n - SCSI Primary Commands 4 and SCSI Block Commands 3 are supported\n - Only one request queue is supported\n - Persistent disks report 4 KiB physical sectors / 512 byte logical sectors\n - Only block devices (disks) are supported\n - The Hotplug / Events feature bit is supported\n\n| **Note:** For second generation Tau T2A and G2, and all third generation and later machine series, you must use an NVMe storage controller instead.\n\n- Serial Ports:\n - Four 16550A ports\n - ttyS0 on IRQ 4\n - ttyS1 on IRQ 3\n - ttyS2 on IRQ 6\n - ttyS3 on IRQ 7\n\nRequired Linux kernel build options\n-----------------------------------\n\nYou must build the operating system kernel with the following options:\n\n- `CONFIG_KVM_GUEST=y`\n - Enable paravirtualization functionality.\n- `CONFIG_KVM_CLOCK=y`\n - Enable the paravirtualized clock (if applies to your kernel version).\n- `CONFIG_VIRTIO_PCI=y`\n - Enable paravirtualized PCI devices.\n- `CONFIG_SCSI_VIRTIO=y`\n - Enable access to paravirtualized disks.\n- `CONFIG_VIRTIO_NET=y`\n - Enable access to networking.\n- `CONFIG_PCI_MSI=y`\n - Enable high-performance interrupt delivery, which is required for local SSD devices.\n\n### Kernel build options for security\n\nUse the recommended security settings in your kernel build options:\n\n- `CONFIG_STRICT_DEVMEM=y`\n - Restrict `/dev/mem` to allow access to only PCI space, BIOS code, and data regions.\n- `CONFIG_DEVKMEM=n`\n - Disable support for `/dev/kmem`.\n - Block access to kernel memory.\n- `CONFIG_DEFAULT_MMAP_MIN_ADDR=65536`\n - Set low virtual memory that is protected from userspace allocation.\n- `CONFIG_DEBUG_RODATA=y`\n - Mark the kernel read-only data as write-protected in the pagetables, to catch accidental (and incorrect) writes to such `const` data. This option can have a slight performance impact because a portion of the kernel code won't be covered by a 2 MB TLB anymore.\n- `CONFIG_DEBUG_SET_MODULE_RONX=y`\n - Catches unintended modifications to loadable kernel module's text and read-only data. This option also prevents execution of module data.\n- `CONFIG_CC_STACKPROTECTOR=y`\n - Enables the `-fstack-protector` GCC feature. This feature puts a canary value at the beginning of critical functions, on the stack before the return address, and validates the value before actually returning. This also causes stack-based buffer overflows (that need to overwrite this return address) to overwrite the canary, which gets detected and the attack is then neutralized using a kernel panic.\n- `CONFIG_COMPAT_VDSO=n`\n - Ensures the VDSO isn't at a predictable address to strengthen ASLR. If enabled, this feature maps the VDSO to the predictable old-style address, providing a predictable location for exploit code to jump to. Say `N` here if you are running a sufficiently recent `glibc` version (2.3.3 or later), to remove the high-mapped VDSO mapping and to exclusively use the randomized VDSO.\n- `CONFIG_COMPAT_BRK=n`\n - Don't disable heap randomization.\n- `CONFIG_X86_PAE=y`\n - Set this option for a 32-bit kernel because PAE is required for NX support. This also enables larger swapspace support for non-overcommit purposes.\n- `CONFIG_SYN_COOKIES=y`\n - Provides some protection against SYN flooding.\n- `CONFIG_SECURITY_YAMA=y`\n - This selects Yama, which extends DAC support with additional system-wide security settings beyond regular Linux discretionary access controls. Currently, the setting is ptrace scope restriction.\n- `CONFIG_SECURITY_YAMA_STACKED=y`\n - This option forces Yama to stack with the selected primary LSM when Yama is available.\n\n### Kernel security settings\n\nYou can also harden the security of the kernel through the kernel settings\nfile. Edit the `/etc/sysctl.conf` file to include the following recommended\nsecurity settings: \n\n # Enable syn flood protection\n net.ipv4.tcp_syncookies = 1\n\n # Ignore source-routed packets\n net.ipv4.conf.all.accept_source_route = 0\n\n # Ignore source-routed packets\n net.ipv4.conf.default.accept_source_route = 0\n\n # Ignore ICMP redirects\n net.ipv4.conf.all.accept_redirects = 0\n\n # Ignore ICMP redirects\n net.ipv4.conf.default.accept_redirects = 0\n\n # Ignore ICMP redirects from non-GW hosts\n net.ipv4.conf.all.secure_redirects = 1\n\n # Ignore ICMP redirects from non-GW hosts\n net.ipv4.conf.default.secure_redirects = 1\n\n # Don't allow traffic between networks or act as a router\n net.ipv4.ip_forward = 0\n\n # Don't allow traffic between networks or act as a router\n net.ipv4.conf.all.send_redirects = 0\n\n # Don't allow traffic between networks or act as a router\n net.ipv4.conf.default.send_redirects = 0\n\n # Reverse path filtering—IP spoofing protection\n net.ipv4.conf.all.rp_filter = 1\n\n # Reverse path filtering—IP spoofing protection\n net.ipv4.conf.default.rp_filter = 1\n\n # Ignore ICMP broadcasts to avoid participating in Smurf attacks\n net.ipv4.icmp_echo_ignore_broadcasts = 1\n\n # Ignore bad ICMP errors\n net.ipv4.icmp_ignore_bogus_error_responses = 1\n\n # Log spoofed, source-routed, and redirect packets\n net.ipv4.conf.all.log_martians = 1\n\n # Log spoofed, source-routed, and redirect packets\n net.ipv4.conf.default.log_martians = 1\n\n # Randomize addresses of mmap base, heap, stack and VDSO page\n kernel.randomize_va_space = 2\n\n # Provide protection from ToCToU races\n fs.protected_hardlinks=1\n\n # Provide protection from ToCToU races\n fs.protected_symlinks=1\n\n # Make locating kernel addresses more difficult\n kernel.kptr_restrict=1\n\n # Set ptrace protections\n kernel.yama.ptrace_scope=1\n\n # Set perf only available to root\n kernel.perf_event_paranoid=2\n\nWhat's next\n-----------\n\n- Install the operating system to a boot disk and [manually import the image](/compute/docs/import/import-existing-image) to Compute Engine as a custom image.\n- If you have already imported your operating system as a custom image, [configure non-kernel settings](/compute/docs/import/configuring-imported-images) on the image so that it can functional optimally within the Compute Engine environment."]]
