Update docs on instant reboot when kernel panic

This commit is contained in:
raja-grewal 2025-08-21 00:24:28 +00:00 committed by GitHub
parent a471069378
commit add054933b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 4 additions and 4 deletions

View file

@ -48,7 +48,7 @@ configuration file and significant hardening is applied to a myriad of component
and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path.
- Force immediate system reboot on the occurrence of a single kernel panic, reducing the
risk and impact of both denial of service and cold boot attacks.
risk and impact of denial of service attacks and both cold and warm boot attacks.
- Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.

View file

@ -188,8 +188,8 @@ kernel.perf_event_paranoid=3
#kernel.warn_limit=1
## Force immediate system reboots on the occurrence of a single kernel panic.
## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to cold boot attacks.
## Increases resilience and limits impact of denial of service attacks as system automatically restarts.
## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks.
## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen.
##
## KSPP=yes

View file

@ -21,6 +21,6 @@ sysctl kernel.oops_limit=1
sysctl kernel.warn_limit=1
## Makes the system immediately reboot on the occurrence of a single
## kernel panic. This reduces the risk and impact of both denial of
## service and cold boot attacks.
## kernel panic. This reduces the risk and impact of denial of
## service attacks and both cold and warmm boot attacks.
sysctl kernel.panic=-1