Kernel hardening (via sysctl & kernel cmdline) #6
Merged
Conversation
This generally matches or exceeds (in strictness) the Fedora Core settings Most stage2 users shouldn't have to worry, but some things are permanently disabled: * echo 1 > /proc/sys/kernel/modules_disabled # No more module loading, even signed * echo 1 > /proc/sys/kernel/kexec_load_disabled # No kexec, defense-in-depth with lockdown * echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled # Permanently disable unprivileged BPF (one-way) Everything else can be managed by stage2 as root if it wishes
…v/kmsg) [ 1.078824] Run /init as init process [ 1.080182] init: Filesystems mounted [ 1.080440] init: Loading kernel modules [ 1.081234] tpm tpm0: auth session is active [ 1.230661] NET: Registered PF_VSOCK protocol family [ 1.246823] init: Setting up networking [ 1.248723] udhcpc: started, v1.37.0 [ 1.251318] udhcpc: broadcasting discover [ 4.262387] udhcpc: broadcasting discover [ 4.278389] udhcpc: broadcasting select for 10.0.2.18, server 10.0.2.1 [ 4.296387] udhcpc: lease of 10.0.2.18 obtained from 10.0.2.1, lease time 43200 [ 4.298528] init: Locking down kernel [ 4.299290] init: Executing stage1
…dprobe first, sysctl second The full output from the init script for example would be: [ 1.083159] Run /init as init process [ 1.084357] init: Filesystems mounted [ 1.084841] init: modprobe: rng-core [ 1.085426] tpm tpm0: auth session is active [ 1.204799] init: modprobe: failover [ 1.209766] init: modprobe: net_failover [ 1.210664] init: modprobe: virtio_pci [ 1.218214] init: modprobe: virtio_net [ 1.225938] init: modprobe: gve [ 1.234520] init: modprobe: ena [ 1.238768] NET: Registered PF_VSOCK protocol family [ 1.239154] init: modprobe: vsock [ 1.245645] init: modprobe: vhost [ 1.252218] init: modprobe: vhost_vsock [ 1.255616] init: modprobe: nitro_enclaves [ 1.256157] init: sysctl: kernel.modules_disabled=1 [ 1.256719] init: sysctl: kernel.kexec_load_disabled=1 [ 1.257305] init: sysctl: kernel.unprivileged_bpf_disabled=1 [ 1.257947] init: sysctl: kernel.sysrq=0 [ 1.258436] init: sysctl: kernel.kptr_restrict=2 [ 1.258981] init: sysctl: kernel.perf_event_paranoid=3 [ 1.259549] init: sysctl: kernel.yama.ptrace_scope=3 [ 1.260097] init: sysctl: kernel.dmesg_restrict=1 [ 1.260698] init: sysctl: net.core.bpf_jit_harden=2 [ 1.261252] init: sysctl: kernel.nmi_watchdog=0 [ 1.261811] init: sysctl: kernel.panic_on_oops=1 [ 1.262361] init: sysctl: kernel.softlockup_panic=1 [ 1.262971] init: sysctl: kernel.hung_task_panic skipped (not found) [ 1.263659] init: sysctl: kernel.panic_on_io_nmi=1 [ 1.264249] init: sysctl: kernel.panic_on_unrecovered_nmi=1 [ 1.264911] init: sysctl: kernel.unknown_nmi_panic=1 [ 1.265553] init: sysctl: kernel.core_pattern=/dev/null [ 1.266222] init: sysctl: fs.suid_dumpable=0 [ 1.266806] init: sysctl: fs.protected_hardlinks=1 [ 1.267410] init: sysctl: fs.protected_symlinks=1 [ 1.268029] init: sysctl: fs.protected_fifos=2 [ 1.268617] init: sysctl: fs.protected_regular=2 [ 1.269197] init: sysctl: kernel.randomize_va_space=2 [ 1.269821] init: sysctl: vm.unprivileged_userfaultfd=0 [ 1.270440] init: sysctl: kernel.io_uring_disabled=2 [ 1.271059] init: sysctl: user.max_user_namespaces=0 [ 1.271650] init: sysctl: dev.tty.ldisc_autoload=0 [ 1.272242] init: sysctl: dev.tty.legacy_tiocsti=0 [ 1.272903] init: sysctl: vm.mmap_min_addr=65536 [ 1.273755] init: sysctl: kernel.ftrace_enabled=0 [ 1.274308] init: sysctl: kernel.stack_tracer_enabled=0 [ 1.274893] init: sysctl: net.ipv4.conf.all.rp_filter=1 [ 1.275560] init: sysctl: net.ipv4.conf.default.rp_filter=1 [ 1.276185] init: sysctl: net.ipv4.conf.all.accept_redirects=0 [ 1.276881] init: sysctl: net.ipv4.conf.default.accept_redirects=0 [ 1.277555] init: sysctl: net.ipv6.conf.all.accept_redirects=0 [ 1.278225] init: sysctl: net.ipv6.conf.default.accept_redirects=0 [ 1.278918] init: sysctl: net.ipv4.conf.all.send_redirects=0 [ 1.279582] init: sysctl: net.ipv4.conf.default.send_redirects=0 [ 1.280204] init: sysctl: net.ipv4.conf.all.accept_source_route=0 [ 1.280870] init: sysctl: net.ipv4.conf.default.accept_source_route=0 [ 1.281535] init: sysctl: net.ipv6.conf.all.accept_source_route=0 [ 1.282185] init: sysctl: net.ipv6.conf.default.accept_source_route=0 [ 1.282891] init: sysctl: net.ipv4.tcp_syncookies=1 [ 1.283497] init: sysctl: net.ipv6.conf.all.accept_ra=0 [ 1.284156] init: sysctl: net.ipv6.conf.default.accept_ra=0 [ 1.284778] init: sysctl: net.core.default_qdisc=fq_codel [ 1.285405] init: sysctl: kernel.pid_max=4194304 [ 1.286789] udhcpc: started, v1.37.0 [ 1.295541] udhcpc: broadcasting discover [ 4.310649] udhcpc: broadcasting discover [ 4.321580] udhcpc: broadcasting select for 10.0.2.18, server 10.0.2.1 [ 4.343564] udhcpc: lease of 10.0.2.18 obtained from 10.0.2.1, lease time 43200 [ 4.357920] init: exec c157c986c3b7e7a0c1980cc3d7244c74e2b7f6e5632f5889c474d5cb8bc93292 /bin/stage1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This generally matches or exceeds (in strictness) the Fedora Core settings
Most stage2 users shouldn't have to worry, but some things are permanently disabled:
Everything else can be managed by stage2 as root if it wishes