diff options
| -rwxr-xr-x | etc.bash | 1 | ||||
| -rw-r--r-- | etc/sysctl.d/98-hardened-overrides.conf | 1 | ||||
| -rw-r--r-- | etc/sysctl.d/99-security.conf | 26 |
3 files changed, 26 insertions, 2 deletions
@@ -6,7 +6,6 @@ sudo cp -v etc/pam.d/system-local-login /etc/pam.d sudo cp -v etc/pam.d/system-login /etc/pam.d sudo cp -v etc/updatedb.conf /etc/ sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d -sudo cp -v etc/sysctl.d/98-hardened-overrides.conf /etc/sysctl.d sudo sysctl --system # firewall diff --git a/etc/sysctl.d/98-hardened-overrides.conf b/etc/sysctl.d/98-hardened-overrides.conf deleted file mode 100644 index c4ee63d..0000000 --- a/etc/sysctl.d/98-hardened-overrides.conf +++ /dev/null @@ -1 +0,0 @@ -kernel.unprivileged_userns_clone = 1 diff --git a/etc/sysctl.d/99-security.conf b/etc/sysctl.d/99-security.conf index ca4c696..a476e40 100644 --- a/etc/sysctl.d/99-security.conf +++ b/etc/sysctl.d/99-security.conf @@ -1,5 +1,31 @@ +# Enable unprivileged user namespaces for rootless podman, flatpak and browser sandboxing +kernel.unprivileged_userns_clone = 1 + +# Kernel pointer & eBPF hardening kernel.kptr_restrict = 2 net.core.bpf_jit_harden = 2 kernel.yama.ptrace_scope = 1 + +# Disable unprivileged eBPf entirely (complements bpf_jit_harden) +kernel.unprivileged_bpf_disabled = 1 + +# Restrict kernel log buffer (dmesg) access to CAP_SYSLOG +kernel.dmesg_restrict = 1 + +# Prevent symlink/hardlink exploits and sticky directory file creation abuses (/tmp) +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1 +fs.protected_fifos = 2 +fs.protected_regular = 2 + +# Loose reverse path filtering (prevents ip spoofing while supporting multi-NIC network interface & containers) net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 + +# Disable ICMP redirect acceptance (prevents MITM route updates) +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.default.accept_redirects = 0 +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 |