Levente Polyak b2ba187738 kernel: further default sysctl hardening ... - unprivileged bpf: we do not need this on our infra, we can assume bpf() calls will happen with CAP_SYS_ADMIN if required. - unprivileged userns: we do not need this on our infra for none of our services or similar. Reduce attack surface by a huge margin including most recent CVE-2020-14386. - kptr restrict: we already check for CAP_SYSLOG and real ids but we really do not require any specific kernel pointers to be logged. Settings this to 2 instead to blank out all kernel pointers to protect against info leak. - kexec: disable kexec as we do never want to kexec our running servers into something else. Settings this sysctl disables kexec even if its compiled into the kernel. - bpf jit harden: harden BPF JIT compiler to mitigate JIT spraying for the sacrifices off a bit performance for all users including privileged.		2020-09-15 19:31:05 +02:00
..
50-bpf_jit_harden.conf	kernel: further default sysctl hardening	2020-09-15 19:31:05 +02:00
50-dmesg-restrict.conf	roles: add a hardening role for sysctl hardening options	2019-05-07 21:07:14 +02:00
50-kexec_load_disabled.conf	kernel: further default sysctl hardening	2020-09-15 19:31:05 +02:00
50-kptr-restrict.conf	kernel: further default sysctl hardening	2020-09-15 19:31:05 +02:00
50-lockdown.conf	roles/hardening: Change the lockdown file creation to run only at boot	2020-02-13 13:40:28 -03:00
50-ptrace-restrict.conf	roles: add a hardening role for sysctl hardening options	2019-05-07 21:07:14 +02:00
50-unprivileged_bpf_disabled.conf	kernel: further default sysctl hardening	2020-09-15 19:31:05 +02:00
50-unprivileged_userns_clone.conf	kernel: further default sysctl hardening	2020-09-15 19:31:05 +02:00