diff options
| author | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 12:21:36 +0200 |
|---|---|---|
| committer | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 12:21:36 +0200 |
| commit | 2ae96cb6b8f40688dd33ecd64de166488b9a888f (patch) | |
| tree | 51177a0d6dba2a9839a776452d5858f2c11b76ab /etc/sysctl.d | |
| parent | dc0a4250aba8511cdd5eff1f7f0e78c81a53bc1e (diff) | |
| download | postinstall-2ae96cb6b8f40688dd33ecd64de166488b9a888f.tar.gz postinstall-2ae96cb6b8f40688dd33ecd64de166488b9a888f.tar.bz2 postinstall-2ae96cb6b8f40688dd33ecd64de166488b9a888f.zip | |
consolidate sysctl config
Diffstat (limited to 'etc/sysctl.d')
| -rw-r--r-- | etc/sysctl.d/98-hardened-overrides.conf | 1 | ||||
| -rw-r--r-- | etc/sysctl.d/99-security.conf | 26 |
2 files changed, 26 insertions, 1 deletions
diff --git a/etc/sysctl.d/98-hardened-overrides.conf b/etc/sysctl.d/98-hardened-overrides.conf deleted file mode 100644 index c4ee63d..0000000 --- a/etc/sysctl.d/98-hardened-overrides.conf +++ /dev/null @@ -1 +0,0 @@ -kernel.unprivileged_userns_clone = 1 diff --git a/etc/sysctl.d/99-security.conf b/etc/sysctl.d/99-security.conf index ca4c696..a476e40 100644 --- a/etc/sysctl.d/99-security.conf +++ b/etc/sysctl.d/99-security.conf @@ -1,5 +1,31 @@ +# Enable unprivileged user namespaces for rootless podman, flatpak and browser sandboxing +kernel.unprivileged_userns_clone = 1 + +# Kernel pointer & eBPF hardening kernel.kptr_restrict = 2 net.core.bpf_jit_harden = 2 kernel.yama.ptrace_scope = 1 + +# Disable unprivileged eBPf entirely (complements bpf_jit_harden) +kernel.unprivileged_bpf_disabled = 1 + +# Restrict kernel log buffer (dmesg) access to CAP_SYSLOG +kernel.dmesg_restrict = 1 + +# Prevent symlink/hardlink exploits and sticky directory file creation abuses (/tmp) +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1 +fs.protected_fifos = 2 +fs.protected_regular = 2 + +# Loose reverse path filtering (prevents ip spoofing while supporting multi-NIC network interface & containers) net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 + +# Disable ICMP redirect acceptance (prevents MITM route updates) +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.default.accept_redirects = 0 +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 |