1 |
On 03/01/20 14:48, Toralf Förster wrote: |
2 |
> On 1/3/20 3:46 PM, Rich Freeman wrote: |
3 |
>> If OpenRC contains a vulnerability wouldn't it make more sense to set |
4 |
>> this as part of OpenRC, |
5 |
> Indeed. |
6 |
> |
7 |
> Furthermore there's a nifty page https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings |
8 |
> which yields for me to this /etc/sysctl.d/local.conf : |
9 |
> |
10 |
> |
11 |
> # Restrict potential illegal access via links |
12 |
> # |
13 |
> fs.protected_hardlinks = 1 |
14 |
> fs.protected_symlinks = 1 |
15 |
> |
16 |
> # |
17 |
> # https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project#CONFIGs |
18 |
> # |
19 |
> |
20 |
> # Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). |
21 |
> kernel.kptr_restrict = 1 |
22 |
> |
23 |
> # Avoid kernel memory address exposures via dmesg. |
24 |
> kernel.dmesg_restrict = 1 |
25 |
> |
26 |
> # Block non-uid-0 profiling (needs distro patch, otherwise this is the same as "= 2") |
27 |
> kernel.perf_event_paranoid = 3 |
28 |
> |
29 |
> # Turn off kexec, even if it's built in. |
30 |
> kernel.kexec_load_disabled = 1 |
31 |
> |
32 |
> # Avoid non-ancestor ptrace access to running processes and their credentials. |
33 |
> kernel.yama.ptrace_scope = 1 |
34 |
> |
35 |
> # Disable User Namespaces, as it opens up a large attack surface to unprivileged users. |
36 |
> user.max_user_namespaces = 0 |
37 |
> |
38 |
> # Turn off unprivileged eBPF access. |
39 |
> kernel.unprivileged_bpf_disabled = 1 |
40 |
> |
41 |
> # Turn on BPF JIT hardening, if the JIT is enabled. |
42 |
> net.core.bpf_jit_harden = 2 |
43 |
> |
44 |
> |
45 |
FWIW, there is a move to add further hardening options to the |
46 |
Gentoo-sources kernel - bug 689154, based on the kernsec recommendations. |
47 |
Further details of proposals, and inspiration, are in the bug. |