Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #268 from raja-grewal/panic_on_warn

Browse Source 
Enable `panic_on_warn=1`
This commit is contained in:
Patrick Schleizer 2024-09-04 10:05:47 -04:00 committed by GitHub
commit 175945ec9a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -43,9 +43,10 @@ Kernel space:
- Restrict kernel profiling and the performance events system to `CAP_PERFMON`.
- Force the kernel to panic on "oopses" that can potentially indicate and thwart
certain kernel exploitation attempts. Optional - Force immediate reboot on the
occurrence of a kernel panic and also set panic limit to one (when using Linux kernel >= 6.2).
- Force the kernel to panic on both "oopses", which can potentially indicate and thwart
certain kernel exploitation attempts, and also kernel warnings in the `WARN()` path.
Optional - Force immediate reboot on the occurrence of a single kernel panic and also
(when using Linux kernel >= 6.2) limit the number of allowed panics to one.
- Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.

10
usr/libexec/security-misc/panic-on-oops
View File

@ -12,12 +12,12 @@ if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
source /usr/libexec/helper-scripts/pre.bsh
fi
## Makes the kernel panic on oopses. This prevents the kernel
## from continuing to run a flawed processes. Many kernel exploits
## will also cause an oops which this will make the kernel kill
## the offending processes.
## Makes the kernel panic on oopses and warnings. This prevents the
## kernel from continuing to run a flawed processes. Many kernel
## exploits will also cause an oops, these settings will make the
## kernel kill the offending processes.
#sysctl kernel.panic=-1
sysctl kernel.panic_on_oops=1
#sysctl kernel.panic_on_warn=1
sysctl kernel.panic_on_warn=1
#sysctl kernel.oops_limit=1
#sysctl kernel.warn_limit=1