Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 15:28:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Force immediate kernel panic on OOM.

Browse source 
This is to avoid security features such as the screen locker, kloak, emerg-shutdown
from being arbitrarily terminated when the system starts running out of memory.

https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14

https://github.com/Kicksecure/security-misc/issues/324

`vm.panic_on_oom=2`

implements https://github.com/Kicksecure/security-misc/issues/324
This commit is contained in:
Patrick Schleizer 2025-10-10 08:03:03 -04:00
parent 98f27c3b2e
commit 968de33c65
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
2 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared
View file

@ -199,6 +199,13 @@ kernel.perf_event_paranoid=3
##
#kernel.panic=-1
## Force immediate kernel panic on OOM.
## This is to avoid security features such as the screen locker, kloak, emerg-shutdown
## from being arbitrarily terminated when the system starts running out of memory.
## https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14
## https://github.com/Kicksecure/security-misc/issues/324
vm.panic_on_oom=2
## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.
## Can lead to privilege escalation by pushing characters into a controlling TTY.
## Will break out-dated screen readers that continue to rely on this legacy functionality.