# Enable unprivileged user namespaces for rootless podman, flatpak and browser sandboxing
kernel.unprivileged_userns_clone = 1

# Kernel pointer & eBPF hardening
kernel.kptr_restrict = 2
net.core.bpf_jit_harden = 2
kernel.yama.ptrace_scope = 1

# Disable unprivileged eBPf entirely (complements bpf_jit_harden)
kernel.unprivileged_bpf_disabled = 1

# Restrict kernel log buffer (dmesg) access to CAP_SYSLOG
kernel.dmesg_restrict = 1

# Prevent symlink/hardlink exploits and sticky directory file creation abuses (/tmp)
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2

# Loose reverse path filtering (prevents ip spoofing while supporting multi-NIC network interface & containers)
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2

# Disable ICMP redirect acceptance (prevents MITM route updates)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0