diff options
Diffstat (limited to 'core/conf/sysctl.conf')
| -rw-r--r-- | core/conf/sysctl.conf | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/core/conf/sysctl.conf b/core/conf/sysctl.conf index 771112a..3cc54d1 100644 --- a/core/conf/sysctl.conf +++ b/core/conf/sysctl.conf @@ -15,6 +15,9 @@ vm.mmap_min_addr=65536 # Allow for more PIDs (to reduce rollover problems); may break some programs 32768 kernel.pid_max = 65536 +#Yama LSM by default +kernel.yama.ptrace_scope = 1 + # # Filesystem Protections # @@ -30,6 +33,8 @@ kernel.kptr_restrict = 2 # Network Protections # +net.core.bpf_jit_enable = 0 + # Increase Linux auto tuning TCP buffer limits # min, default, and max number of bytes to use # set max to at least 4MB, or higher if you use very high BDP paths @@ -39,6 +44,9 @@ net.core.wmem_max = 8388608 net.core.netdev_max_backlog = 5000 net.ipv4.tcp_window_scaling = 1 +#A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic. +net.ipv4.tcp_sack = 0 + # Both ports linux-blob and linux-libre don't build with ipv6 # Disable ipv6 net.ipv6.conf.all.disable_ipv6 = 1 @@ -91,6 +99,7 @@ net.ipv4.conf.default.rp_filter = 1 #net.ipv6.conf.default.rp_filter = 1 #net.ipv6.conf.all.rp_filter = 1 + # Make sure no one can alter the routing tables # Act as a router, necessary for Access Point net.ipv4.conf.all.accept_redirects = 0 @@ -131,3 +140,4 @@ net.ipv4.tcp_keepalive_time = 1800 net.ipv4.tcp_synack_retries = 3 # End of file + |