diff mbox series

hide kernel addresses in /proc against privileged users

Message ID 015ae288-bd5a-15c1-151a-3189d769a984@link38.eu
State Dropped
Headers
Series hide kernel addresses in /proc against privileged users |

Commit Message

Peter Müller Jan. 21, 2019, 4:03 a.m. UTC 
  In order to make local privilege escalation more harder, hide
kernel addresses in various /proc files against users with
root (or similar) permissions, too.

Common system hardening tools such as lynis recommend this.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 setup/sysctl/kernel-hardening.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Tremer Jan. 21, 2019, 9:17 p.m. UTC | #1 
Hello,

Please increment the release number of this package.

Best,
-Michael

> On 20 Jan 2019, at 17:03, Peter Müller <peter.mueller@link38.eu> wrote:
> 
> In order to make local privilege escalation more harder, hide
> kernel addresses in various /proc files against users with
> root (or similar) permissions, too.
> 
> Common system hardening tools such as lynis recommend this.
> 
> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
> ---
> setup/sysctl/kernel-hardening.conf | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf
> index 6751bbef6..9bb6e9f45 100644
> --- a/setup/sysctl/kernel-hardening.conf
> +++ b/setup/sysctl/kernel-hardening.conf
> @@ -1,5 +1,5 @@
> # Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc).
> -kernel.kptr_restrict = 1
> +kernel.kptr_restrict = 2
> 
> # Avoid kernel memory address exposures via dmesg.
> kernel.dmesg_restrict = 1
> -- 
> 2.16.4
diff mbox series

Patch

diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf
index 6751bbef6..9bb6e9f45 100644
--- a/setup/sysctl/kernel-hardening.conf
+++ b/setup/sysctl/kernel-hardening.conf
@@ -1,5 +1,5 @@ 
 # Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc).
-kernel.kptr_restrict = 1
+kernel.kptr_restrict = 2
 
 # Avoid kernel memory address exposures via dmesg.
 kernel.dmesg_restrict = 1