From: Peter Müller <peter.mueller@ipfire.org>
Date: Fri, 15 Sep 2023 12:41:42 +0000 (+0200)
Subject: setup: Port sysctl hardening settings from IPFire 2.x
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=09fdf6992c79b7dfef9bd0a9d66eed844ded1a32;p=ipfire-3.x.git

setup: Port sysctl hardening settings from IPFire 2.x

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---

diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf
index d92485d61..6f782e0b1 100644
--- a/setup/sysctl/kernel-hardening.conf
+++ b/setup/sysctl/kernel-hardening.conf
@@ -11,3 +11,18 @@ vm.mmap_rnd_compat_bits = 16
 # Turn on hard- and symlink protection
 fs.protected_symlinks = 1
 fs.protected_hardlinks = 1
+
+# Don't allow writes to files and FIFOs that we don't own in world writable sticky
+# directories, unless they are owned by the owner of the directory.
+fs.protected_fifos = 2
+fs.protected_regular = 2
+
+# Include PID in file names of generated core dumps
+kernel.core_uses_pid = 1
+
+# Block non-uid-0 profiling
+kernel.perf_event_paranoid = 3
+
+# Restrict loading TTY line disciplines to CAP_SYS_MODULE to prevent unprivileged attackers
+# from loading vulnerable line disciplines with the TIOCSETD ioctl.
+dev.tty.ldisc_autoload = 0