diff --git a/README.md b/README.md index acded8d..8c232ae 100644 --- a/README.md +++ b/README.md @@ -52,7 +52,7 @@ configuration file and significant hardening is applied to a myriad of component - Force immediate system reboot on the occurrence of a single kernel panic, reducing the risk and impact of denial of service attacks and both cold and warm boot attacks. -- Force immediate kernel panic on OOM. This is to avoid security features such as the screen +- Optional - Force immediate kernel panic on OOM. This is to avoid security features such as the screen locker, kloak, emerg-shutdown from being arbitrarily terminated when the system starts running out of memory. diff --git a/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared index 78e5e5f..a4914da 100644 --- a/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared +++ b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared @@ -204,7 +204,9 @@ kernel.perf_event_paranoid=3 ## from being arbitrarily terminated when the system starts running out of memory. ## https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 ## https://github.com/Kicksecure/security-misc/issues/324 -vm.panic_on_oom=2 +## Needs more work. +## +#vm.panic_on_oom=2 ## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. ## Can lead to privilege escalation by pushing characters into a controlling TTY.