From d26a4e12deafade205d37a9fda748a6b78dfdb6a Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Sat, 25 Feb 2017 18:40:03 +0000 Subject: overall revesion --- core/linux.html | 71 +++++++++++++++++++++++++++------------------------------ 1 file changed, 34 insertions(+), 37 deletions(-) (limited to 'core/linux.html') diff --git a/core/linux.html b/core/linux.html index 903d9e2..888b916 100644 --- a/core/linux.html +++ b/core/linux.html @@ -164,9 +164,8 @@ kernel.printk = 7 1 1 4 kernel.randomize_va_space = 2 - kernel.kptr_restrict = 2 # Shared Memory - kernel.shmmax = 500000000 + #kernel.shmmax = 500000000 # Total allocated file handlers that can be allocated # fs.file-nr= vm.mmap_min_addr=65536 @@ -188,7 +187,6 @@ # If you're using XFree86 or a version of Xorg from 2012 or earlier, # you may not be able to boot into a graphical environment with this # option enabled. In this case, you should use the RBAC system instead. - #kernel.grsecurity.disable_priv_io = 1 kernel.grsecurity.disable_priv_io = 0 # If you say Y here, attempts to bruteforce exploits against forking @@ -207,7 +205,7 @@ # signal. # If the sysctl option is enabled, a sysctl option with name # "deter_bruteforce" is created. - #kernel.grsecurity.deter_bruteforce = 1 + kernel.grsecurity.deter_bruteforce = 1 # # Filesystem Protections @@ -223,7 +221,7 @@ # symlink is the owner of the directory. users will also not be # able to hardlink to files they do not own. If the sysctl option is # enabled, a sysctl option with name "linking_restrictions" is created. - kernel.grsecurity.linking_restrictions = 1 + kernel.grsecurity.linking_restrictions = 0 # Apache's SymlinksIfOwnerMatch option has an inherent race condition @@ -237,7 +235,7 @@ # will be in place for the group you specify. If the sysctl option # is enabled, a sysctl option with name "enforce_symlinksifowner" is # created. - #kernel.grsecurity.enforce_symlinksifowner = 1 + kernel.grsecurity.enforce_symlinksifowner = 0 #kernel.grsecurity.symlinkown_gid = 33 # if you say Y here, users will not be able to write to FIFOs they don't @@ -245,7 +243,7 @@ # the FIFO is the same owner of the directory it's held in. If the sysctl # option is enabled, a sysctl option with name "fifo_restrictions" is # created. - #kernel.grsecurity.fifo_restrictions = 1 + kernel.grsecurity.fifo_restrictions = 0 # If you say Y here, a sysctl option with name "romount_protect" will # be created. By setting this option to 1 at runtime, filesystems @@ -280,14 +278,14 @@ # against another published method of breaking a chroot. If the sysctl # option is enabled, a sysctl option with name "chroot_deny_chmod" is # created. - kernel.grsecurity.chroot_deny_chmod = 1 + kernel.grsecurity.chroot_deny_chmod = 1 # If you say Y here, processes inside a chroot will not be able to chroot # again outside the chroot. This is a widely used method of breaking # out of a chroot jail and should not be allowed. If the sysctl # option is enabled, a sysctl option with name # "chroot_deny_chroot" is created. - kernel.grsecurity.chroot_deny_chroot = 1 + kernel.grsecurity.chroot_deny_chroot = 1 # If you say Y here, a well-known method of breaking chroots by fchdir'ing # to a file descriptor of the chrooting process that points to a directory @@ -400,7 +398,7 @@ # limit. It is highly recommended that you say Y here. If the sysctl # option is enabled, a sysctl option with name "resource_logging" is # created. If the RBAC system is enabled, the sysctl value is ignored. - #kernel.grsecurity.resource_logging = 1 + kernel.grsecurity.resource_logging = 1 # If you say Y here, all executions inside a chroot jail will be logged # to syslog. This can cause a large amount of logs if certain @@ -412,8 +410,7 @@ # If you say Y here, all attempts to attach to a process via ptrace # will be logged. If the sysctl option is enabled, a sysctl option # with name "audit_ptrace" is created. - #kernel.grsecurity.audit_ptrace = 1 - kernel.grsecurity.audit_ptrace = 0 + kernel.grsecurity.audit_ptrace = 1 # If you say Y here, all attempts to attach to a process via ptrace # will be logged. If the sysctl option is enabled, a sysctl option @@ -423,27 +420,26 @@ # If you say Y here, all mounts and unmounts will be logged. If the # sysctl option is enabled, a sysctl option with name "audit_mount" is # created. - #kernel.grsecurity.audit_mount = 1 - kernel.grsecurity.audit_mount = 0 + kernel.grsecurity.audit_mount = 1 # If you say Y here, certain important signals will be logged, such as # SIGSEGV, which will as a result inform you of when a error in a program # occurred, which in some cases could mean a possible exploit attempt. # If the sysctl option is enabled, a sysctl option with name # "signal_logging" is created. - kernel.grsecurity.signal_logging = 0 + kernel.grsecurity.signal_logging = 1 # If you say Y here, all failed fork() attempts will be logged. # This could suggest a fork bomb, or someone attempting to overstep # their process limit. If the sysctl option is enabled, a sysctl option # with name "forkfail_logging" is created. #kernel.grsecurity.forkfail_logging = 1 - kernel.grsecurity.forkfail_logging = 0 + kernel.grsecurity.forkfail_logging = 1 # If you say Y here, any changes of the system clock will be logged. # If the sysctl option is enabled, a sysctl option with name # "timechange_logging" is created. - #kernel.grsecurity.timechange_logging = 1 + kernel.grsecurity.timechange_logging = 1 # if you say Y here, calls to mmap() and mprotect() with explicit # usage of PROT_WRITE and PROT_EXEC together will be logged when @@ -452,7 +448,7 @@ # is enabled on a binary, like textrels and PT_GNU_STACK. If the # sysctl option is enabled, a sysctl option with name "rwxmap_logging" # is created. - #kernel.grsecurity.rwxmap_logging = 1 + kernel.grsecurity.rwxmap_logging = 1 # # Executable Protections @@ -469,7 +465,7 @@ kernel.grsecurity.dmesg = 1 # Hide symbol addresses in /proc/kallsyms - kernel.kptr_restrict = 1 + #kernel.kptr_restrict = 2 # If you say Y here, TTY sniffers and other malicious monitoring # programs implemented through ptrace will be defeated. If you @@ -505,7 +501,7 @@ # same way, allowing the other threads of the process to continue # running with root privileges. If the sysctl option is enabled, # a sysctl option with name "consistent_setxid" is created. - #kernel.grsecurity.consistent_setxid = 1 + kernel.grsecurity.consistent_setxid = 0 # If you say Y here, access to overly-permissive IPC objects (shared # memory, message queues, and semaphores) will be denied for processes @@ -523,7 +519,7 @@ # CAP_IPC_OWNER are still permitted to access these IPC objects. # If the sysctl option is enabled, a sysctl option with name # "harden_ipc" is created. - kernel.grsecurity.harden_ipc = 1 + kernel.grsecurity.harden_ipc = 0 # If you say Y here, you will be able to choose a gid to add to the # supplementary groups of users you want to mark as "untrusted." @@ -531,7 +527,7 @@ # root-owned directories writable only by root. If the sysctl option # is enabled, a sysctl option with name "tpe" is created. kernel.grsecurity.tpe = 1 - kernel.grsecurity.tpe_gid = 101 + kernel.grsecurity.tpe_gid = 4 # If you say Y here, the group you specify in the TPE configuration will # decide what group TPE restrictions will be *disabled* for. This @@ -550,10 +546,11 @@ # world-writable, or in directories owned by root and writable only by # root. If the sysctl option is enabled, a sysctl option with name # "tpe_restrict_all" is created. - kernel.grsecurity.tpe_restrict_all = 0 + kernel.grsecurity.tpe_restrict_all = 1 - #kernel.grsecurity.harden_tty = 1 + kernel.grsecurity.harden_tty = 1 + # # Network Protections # @@ -687,14 +684,14 @@ # "tcp_retries1" and "tcp_retries2". The default value of 4 # prevents a socket from lasting more than 45 seconds in LAST_ACK # state. - #kernel.grsecurity.ip_blackhole = 1 - #kernel.grsecurity.lastack_retries = 4 + kernel.grsecurity.ip_blackhole = 1 + kernel.grsecurity.lastack_retries = 4 # If you say Y here, you will be able to choose a GID of whose users will # be unable to connect to other hosts from your machine or run server # applications from your machine. If the sysctl option is enabled, a # sysctl option with name "socket_all" is created. - #kernel.grsecurity.socket_all = 1 + kernel.grsecurity.socket_all = 0 # Here you can choose the GID to disable socket access for. Remember to # add the users you want socket access disabled for to the GID @@ -708,13 +705,13 @@ # you specify will have to use passive mode when initiating ftp transfers # from the shell on your machine. If the sysctl option is enabled, a # sysctl option with name "socket_client" is created. - #kernel.grsecurity.socket_client = 1 + kernel.grsecurity.socket_client = 1 # Here you can choose the GID to disable client socket access for. # Remember to add the users you want client socket access disabled for to # the GID specified here. If the sysctl option is enabled, a sysctl # option with name "socket_client_gid" is created. - #kernel.grsecurity.socket_client_gid = 203 + kernel.grsecurity.socket_client_gid = 15 # If you say Y here, you will be able to choose a GID of whose users will # be unable to connect to other hosts from your machine, but will be @@ -722,13 +719,13 @@ # you specify will have to use passive mode when initiating ftp transfers # from the shell on your machine. If the sysctl option is enabled, a # sysctl option with name "socket_client" is created. - #kernel.grsecurity.socket_server = 1 + kernel.grsecurity.socket_server = 1 # Here you can choose the GID to disable server socket access for. # Remember to add the users you want server socket access disabled for to # the GID specified here. If the sysctl option is enabled, a sysctl # option with name "socket_server_gid" is created. - #kernel.grsecurity.socket_server_gid = 204 + kernel.grsecurity.socket_server_gid = 99 # # Physical Protections @@ -744,12 +741,12 @@ # For greatest effectiveness, this sysctl should be set after any # relevant init scripts. This option is safe to enable in distros # as each user can choose whether or not to toggle the sysctl. - #kernel.grsecurity.deny_new_usb = 0 + kernel.grsecurity.deny_new_usb = 0 # # Restrict grsec sysctl changes after this was set # - #kernel.grsecurity.grsec_lock = 1 + kernel.grsecurity.grsec_lock = 0 # End of file @@ -757,10 +754,10 @@ Core OS Index

This is part of the c9-doc Manual. -Copyright (C) 2017 -c9 team. -See the file Gnu Free Documentation License -for copying conditions.

+ Copyright (C) 2017 + c9 team. + See the file Gnu Free Documentation License + for copying conditions.

-- cgit 1.4.1-2-gfad0 72713af8e7c698ddea4b56'>^ 
6cca399 ^

720b2ab ^

8e6eb52 ^

0c5f47e ^

82ddba8 ^

a2175cf ^

e06447e ^

760e23d ^

9996439 ^

3764ab4 ^

58e6866 ^

beac539 ^

a768ea9 ^

177ed7e ^

936e11f ^

b65a1e3 ^

ea4827a ^

82fed98 ^

5732e47 ^

f577fe4 ^

0d095ae ^

ab83872 ^

dc66237 ^

0d9d3e7 ^

5c48012 ^

7d071ce ^

7c9fa25 ^

81aebf8 ^

4e49d5a ^

f2190c8 ^

cc79700 ^

f651435 ^

b0477c3 ^

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51