From 2ae96cb6b8f40688dd33ecd64de166488b9a888f Mon Sep 17 00:00:00 2001 From: Denis Chevalier Date: Thu, 6 Aug 2026 12:21:36 +0200 Subject: consolidate sysctl config --- etc/sysctl.d/98-hardened-overrides.conf | 1 - etc/sysctl.d/99-security.conf | 26 ++++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) delete mode 100644 etc/sysctl.d/98-hardened-overrides.conf (limited to 'etc/sysctl.d') diff --git a/etc/sysctl.d/98-hardened-overrides.conf b/etc/sysctl.d/98-hardened-overrides.conf deleted file mode 100644 index c4ee63d..0000000 --- a/etc/sysctl.d/98-hardened-overrides.conf +++ /dev/null @@ -1 +0,0 @@ -kernel.unprivileged_userns_clone = 1 diff --git a/etc/sysctl.d/99-security.conf b/etc/sysctl.d/99-security.conf index ca4c696..a476e40 100644 --- a/etc/sysctl.d/99-security.conf +++ b/etc/sysctl.d/99-security.conf @@ -1,5 +1,31 @@ +# Enable unprivileged user namespaces for rootless podman, flatpak and browser sandboxing +kernel.unprivileged_userns_clone = 1 + +# Kernel pointer & eBPF hardening kernel.kptr_restrict = 2 net.core.bpf_jit_harden = 2 kernel.yama.ptrace_scope = 1 + +# Disable unprivileged eBPf entirely (complements bpf_jit_harden) +kernel.unprivileged_bpf_disabled = 1 + +# Restrict kernel log buffer (dmesg) access to CAP_SYSLOG +kernel.dmesg_restrict = 1 + +# Prevent symlink/hardlink exploits and sticky directory file creation abuses (/tmp) +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1 +fs.protected_fifos = 2 +fs.protected_regular = 2 + +# Loose reverse path filtering (prevents ip spoofing while supporting multi-NIC network interface & containers) net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 + +# Disable ICMP redirect acceptance (prevents MITM route updates) +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.default.accept_redirects = 0 +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 -- cgit