Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-11 11:39:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

comment

Browse Source
This commit is contained in:
Patrick Schleizer 2023-01-25 15:20:30 -05:00
parent 65c29f493b
commit 8c3204a5e4
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/sysctl.d/30_security-misc_kexec-disable.conf
View File

@ -8,3 +8,9 @@
## A toggle indicating if the kexec_load syscall has been disabled. This value defaults to 0 (false: kexec_load enabled), but can be set to 1 (true: kexec_load disabled). Once true, kexec can no longer be used, and the toggle cannot be set back to false. This allows a kexec image to be loaded before disabling the syscall, allowing a system to set up (and later use) an image without it being altered. Generally used together with the "modules_disabled" sysctl.
## Disables kexec which can be used to replace the running kernel.
kernel.kexec_load_disabled=1
## Why is this in a dedicated config file?
## Package ram-wipe requires kexec. However, ram-wipe could not ship a config
## file /etc/sysctl.d/40_ram-wipe.conf which sets 'kernel.kexec_load_disabled=0'.
## This is because once systemd-sysctl.service has set 'kernel.kexec_load_disabled=1'
## it cannot be undone without reboot. This is a upstream Linux security feature.