blob: d2b9b1b2d0d957fbfe14f3c01d4a7f49c89eb668 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
# Enable unprivileged user namespaces for rootless podman, flatpak and browser sandboxing
kernel.unprivileged_userns_clone = 1
# Kernel pointer & eBPF hardening
kernel.kptr_restrict = 2
net.core.bpf_jit_harden = 2
kernel.yama.ptrace_scope = 1
# Disable unprivileged eBPf entirely (complements bpf_jit_harden)
kernel.unprivileged_bpf_disabled = 1
# Restrict kernel log buffer (dmesg) access to CAP_SYSLOG
kernel.dmesg_restrict = 1
# Prevent symlink/hardlink exploits and sticky directory file creation abuses (/tmp)
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2
# Loose reverse path filtering (prevents ip spoofing while supporting multi-NIC network interface & containers)
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2
# Disable ICMP redirect acceptance (prevents MITM route updates)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
# Prevent setuid binaries or privileged processes from dumping core
fs.suid_dumpable = 0
|
