Patrick Schleizer
|
b0baa8baa5
|
add link
|
2025-01-12 05:38:35 -05:00 |
|
Patrick Schleizer
|
d6a7cd3e0d
|
formatting.
use chapter to make allow for deep linking
|
2025-01-12 05:36:16 -05:00 |
|
Patrick Schleizer
|
e9ef3602dd
|
Merge pull request #292 from raja-grewal/cpu_table
Add link to tabular comparison of CPU mitigations
|
2025-01-10 10:30:34 -05:00 |
|
Patrick Schleizer
|
1b33e83529
|
Merge pull request #291 from raja-grewal/drop_gratuitous_arp
Drop gratuitous ARP packets
|
2025-01-10 10:29:30 -05:00 |
|
Patrick Schleizer
|
486757bfae
|
Merge pull request #290 from raja-grewal/arp_ignore
Respond to ARP requests only if the target IP address is on-link
|
2025-01-10 10:29:12 -05:00 |
|
Patrick Schleizer
|
17ff249150
|
Merge pull request #289 from raja-grewal/arp_filter
Enable ARP filtering
|
2025-01-10 10:28:48 -05:00 |
|
Patrick Schleizer
|
27d19ba568
|
Merge pull request #288 from raja-grewal/shared_media
Deny sending and receiving shared media redirects
|
2025-01-10 10:28:05 -05:00 |
|
raja-grewal
|
cf435a8fa8
|
README.md: Note importance of microcode updates
|
2025-01-10 13:22:21 +11:00 |
|
raja-grewal
|
5e3785d76e
|
README.md: Remove double space
|
2025-01-08 18:35:52 +11:00 |
|
Patrick Schleizer
|
0640964c35
|
readme
|
2024-12-31 06:14:29 -05:00 |
|
raja-grewal
|
2e6e1701a0
|
Set net.ipv4.conf.*.drop_gratuitous_arp=1
|
2024-12-19 10:35:08 +00:00 |
|
raja-grewal
|
c37f4efadf
|
Set net.ipv4.conf.*.arp_ignore=2
|
2024-12-19 10:33:49 +00:00 |
|
raja-grewal
|
af1d06973b
|
Set net.ipv4.conf.*.arp_filter=1
|
2024-12-19 10:31:43 +00:00 |
|
raja-grewal
|
750367a906
|
Set net.ipv4.conf.*.shared_media=0
|
2024-12-19 10:29:56 +00:00 |
|
Patrick Schleizer
|
c7f7196471
|
Merge pull request #287 from raja-grewal/patch
Refactor and add two CPU mitigations
|
2024-12-19 00:31:25 -05:00 |
|
Patrick Schleizer
|
e5b67e044b
|
Merge pull request #279 from raja-grewal/arp
Provide network-related hardening options via `sysctl`'s
|
2024-12-19 00:15:02 -05:00 |
|
raja-grewal
|
3749f8ff09
|
Update presentation on user namespaces
|
2024-12-18 03:36:09 +00:00 |
|
Aaron Rainbolt
|
1708a03e1e
|
Enable umask hardening
|
2024-11-28 15:39:59 -06:00 |
|
raja-grewal
|
141b84c40d
|
Provide option to deny sending and receiving shared media redirects
|
2024-11-13 05:42:56 +00:00 |
|
raja-grewal
|
18aec201bf
|
Provide option to harden response to ARP requests
|
2024-11-13 05:41:25 +00:00 |
|
raja-grewal
|
a25d4f8df8
|
Provide option to enable ARP filtering
|
2024-11-13 05:40:21 +00:00 |
|
raja-grewal
|
c2aae73ce1
|
Add reference and move text
|
2024-11-13 05:38:03 +00:00 |
|
raja-grewal
|
a1d1f97955
|
Provide option to drop gratuitous ARP packets
|
2024-11-08 03:58:23 +00:00 |
|
raja-grewal
|
eb72163d57
|
README.md: Make line lengths consistent
|
2024-10-14 03:01:15 +00:00 |
|
raja-grewal
|
a9f238fe04
|
README.md: Split optional setting to new line
|
2024-10-14 02:57:31 +00:00 |
|
raja-grewal
|
0c0774f6c0
|
Merge branch 'master' into text_2
|
2024-10-06 10:48:52 +00:00 |
|
raja-grewal
|
dc470cac1d
|
Remmove deprecated link
|
2024-10-06 10:46:05 +00:00 |
|
Patrick Schleizer
|
0e3ffa3f11
|
no longer set kernel.unprivileged_userns_clone=0
because it breaks too much
fixes https://github.com/Kicksecure/security-misc/issues/274
|
2024-10-03 02:58:58 -04:00 |
|
raja-grewal
|
ac1378743c
|
Consistent formatting
|
2024-09-30 16:56:18 +10:00 |
|
raja-grewal
|
eae38e72f3
|
README.md: Show the current max_map_count
|
2024-09-26 13:10:36 +00:00 |
|
raja-grewal
|
769767a96a
|
Update mmap ASLR docs
|
2024-09-25 09:54:49 +10:00 |
|
Patrick Schleizer
|
01908d505a
|
readme
|
2024-09-05 07:00:11 -04:00 |
|
Patrick Schleizer
|
e914028be7
|
add KSPP compliance status to readme based on comment by @raja-grewal
https://github.com/Kicksecure/security-misc/issues/256#issuecomment-2330376651
|
2024-09-05 06:03:05 -04:00 |
|
Patrick Schleizer
|
563a898013
|
Merge pull request #265 from raja-grewal/mmap_min_addr
Set `sysctl vm.mmap_min_addr=65536`
|
2024-09-04 10:11:48 -04:00 |
|
Raja Grewal
|
3101035a3f
|
Enable panic_on_warn=1
|
2024-08-29 01:57:32 +10:00 |
|
Patrick Schleizer
|
f70fe308a9
|
no longer set sysctl fs.binfmt_misc.status=0 /
no longer disallow registering interpreters for miscellaneous binary formats
causing file/folder permissions issue `d????????? ? ? ? ? ? .`
Firefox no longer starting (probably not not a Firefox issue)
https://github.com/Kicksecure/security-misc/issues/267
|
2024-08-28 06:49:50 -04:00 |
|
Raja Grewal
|
9e91c98cc9
|
Add details on BPF hardening and split the sysctls
|
2024-08-26 12:40:04 +10:00 |
|
Raja Grewal
|
2841d789be
|
README: Update
|
2024-08-26 11:21:26 +10:00 |
|
raja-grewal
|
9dbd200be4
|
Merge branch 'Kicksecure:master' into kspp_compliance
|
2024-08-26 11:08:21 +10:00 |
|
Patrick Schleizer
|
73900b59db
|
Merge pull request #263 from raja-grewal/max_user_namespaces
Provide option to disable user namespaces
|
2024-08-25 11:00:51 -04:00 |
|
Raja Grewal
|
e4909b5e28
|
Add details on kernel panics
|
2024-08-25 12:47:04 +10:00 |
|
Raja Grewal
|
342caf82b2
|
README.md: Organise kernel boot parameters
|
2024-08-21 12:52:48 +10:00 |
|
Raja Grewal
|
b87a18d405
|
README.md: Organise sysctls
|
2024-08-21 12:51:51 +10:00 |
|
Raja Grewal
|
18ed77ecc9
|
Refactor modprobe.d to minimise potential future merge conflicts
|
2024-08-21 12:50:14 +10:00 |
|
Raja Grewal
|
e61027a40e
|
Set sysctl vm.mmap_min_addr=65536
|
2024-08-19 11:32:20 +10:00 |
|
Raja Grewal
|
683110e7f0
|
Correction
|
2024-08-19 01:34:14 +10:00 |
|
Raja Grewal
|
759aee8150
|
Provide option to disable user namespaces
|
2024-08-16 22:54:57 +10:00 |
|
Patrick Schleizer
|
305467c652
|
Merge pull request #245 from raja-grewal/blacklist_to_disable
Update `/etc/modprobe.d/*`
|
2024-08-16 04:25:43 -04:00 |
|
raja-grewal
|
81bf7a8f90
|
Merge branch 'Kicksecure:master' into docs
|
2024-08-16 16:57:01 +10:00 |
|
Patrick Schleizer
|
ef60c5b153
|
Merge pull request #249 from raja-grewal/binfmt_misc
Disallow registering interpreters for miscellaneous binary formats
|
2024-08-16 02:43:57 -04:00 |
|