diff --git a/README.md b/README.md index 96f8b14..d4dd706 100644 --- a/README.md +++ b/README.md @@ -57,9 +57,8 @@ space, user space, core dumps, and swap space. - Increase the maximum number of memory map areas a process is able to utilize. -- Provide the option to disallow registering interpreters for various (miscellaneous) - binary formats based on a magic number or their file extension to prevent - unintended code execution. +- Disallow registering interpreters for various (miscellaneous) binary formats based + on a magic number or their file extension to prevent unintended code execution. - Disable core dump files and prevent their creation. If core dump files are enabled, they will be named based on `core.PID` instead of the default `core`. diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf index 4de859c..747ca67 100644 --- a/usr/lib/sysctl.d/990-security-misc.conf +++ b/usr/lib/sysctl.d/990-security-misc.conf @@ -206,11 +206,8 @@ vm.max_map_count=1048576 ## https://en.wikipedia.org/wiki/Binfmt_misc ## https://security.stackexchange.com/questions/271786/does-allowing-binfmt-misc-significantly-increase-the-attack-surface-for-unprivil ## https://unix.stackexchange.com/questions/439569/what-kinds-of-executable-formats-do-the-files-under-proc-sys-fs-binfmt-misc-al -## https://github.com/Kicksecure/security-misc/pull/249 ## -## The default kernel setting will be utilized until provided sufficient evidence to modify. -## -#fs.binfmt_misc.status=0 +fs.binfmt_misc.status=0 ## 3. Core Dumps: ##