Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-19 06:54:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Add details on kernel panics

Browse source
This commit is contained in:
Raja Grewal 2024-08-25 12:47:04 +10:00
parent 56b28e3826
commit e4909b5e28
No known key found for this signature in database
GPG key ID: 92CA473C156B64C4
4 changed files with 20 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

18
usr/lib/sysctl.d/990-security-misc.conf
View file

@ -132,20 +132,28 @@ kernel.unprivileged_userns_clone=0
##
kernel.perf_event_paranoid=3
## Force the kernel to panic on "oopses".
## Force the kernel to panic on "oopses" and kernel warnings in the WARN() path.
## Can sometimes potentially indicate and thwart certain kernel exploitation attempts.
## Also cause panics on machine check exceptions.
## Panics may be due to false-positives such as bad drivers.
##
## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713
## https://en.wikipedia.org/wiki/Kernel_panic#Linux
## https://en.wikipedia.org/wiki/Linux_kernel_oops
## https://en.wikipedia.org/wiki/Kdump_(Linux)
## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panisc-on-oops-1-sysctl-for-better-security/7713
##
## KSPP=partial
## KSPP sets CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1.
## KSPP sets the sysctls, CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1.
##
## See /usr/libexec/security-misc/panic-on-oops for implementation.
##
#kernel.panic_on_oops=1
## TODO: Debian 13 Trixie
## The limits are applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness).
##
#kernel.panic=-1
kernel.panic_on_oops=1
#kernel.panic_on_warn=1
#kernel.oops_limit=1
#kernel.warn_limit=1
## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.
## Can lead to privilege escalation by pushing characters into a controlling TTY.