Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-13 01:59:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Patrick Schleizer 2020-03-11 09:08:41 -04:00
commit e6e7886a6e
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs
View File

@ -15,7 +15,8 @@ prereqs)
;; ;;
esac esac
sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2>${rootmnt}/var/log/sysctl-initramfs-error.log
sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>>${rootmnt}/var/log/sysctl-initramfs-error.log
grep -v "unprivileged_userfaultfd" /var/log/sysctl-initramfs-error.log
true true

4
etc/sysctl.d/30_security-misc.conf
View File

@ -134,10 +134,8 @@ kernel.sysrq=132
## https://lkml.org/lkml/2019/4/15/890 ## https://lkml.org/lkml/2019/4/15/890
dev.tty.ldisc_autoload=0 dev.tty.ldisc_autoload=0
## Disable for now.
## https://forums.whonix.org/t/kernel-hardening/7296/406
## Restrict the userfaultfd() syscall to root as it can make heap sprays ## Restrict the userfaultfd() syscall to root as it can make heap sprays
## easier. ## easier.
## ##
## https://duasynt.com/blog/linux-kernel-heap-spray ## https://duasynt.com/blog/linux-kernel-heap-spray
#vm.unprivileged_userfaultfd=0 vm.unprivileged_userfaultfd=0