Skip to content
Log In

Guide to the Secure Configuration of Fedora

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Add nodev Option to /var

    The <code>nodev</code> mount option can be used to prevent device files from being created in <code>/var</code>. Legitimate character and block devices should exist only in the <code>/dev</code> di...
    Rule Medium Severity
    Show

  • Add noexec Option to /var

    The <code>noexec</code> mount option can be used to prevent binaries from being executed out of <code>/var</code>. Add the <code>noexec</code> option to the fourth column of <code>/etc/fstab</code>...
    Rule Medium Severity
    Show

  • Bind Mount /var/tmp To /tmp

    The <code>/var/tmp</code> directory is a world-writable directory. Bind-mount it to <code>/tmp</code> in order to consolidate temporary storage into one location protected by the same techniques as...
    Rule Unknown Severity
    Show

  • Add nodev Option to /var/tmp

    The <code>nodev</code> mount option can be used to prevent device files from being created in <code>/var/tmp</code>. Legitimate character and block devices should not exist within temporary directo...
    Rule Medium Severity
    Show

  • Add noexec Option to /var/tmp

    The <code>noexec</code> mount option can be used to prevent binaries from being executed out of <code>/var/tmp</code>. Add the <code>noexec</code> option to the fourth column of <code>/etc/fstab</c...
    Rule Medium Severity
    Show

  • Add nosuid Option to /var/tmp

    The <code>nosuid</code> mount option can be used to prevent execution of setuid programs in <code>/var/tmp</code>. The SUID and SGID permissions should not be required in these world-writable direc...
    Rule Medium Severity
    Show

  • Disable storing core dump

    The Storage option in [Coredump] sectionof /etc/systemd/coredump.conf can be set to none to disable storing core dumps permanently.
    Rule Medium Severity
    Show

  • Restrict Access to Kernel Message Buffer

    To set the runtime status of the <code>kernel.dmesg_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.dmesg_restrict=1</pre> To make sure that the setting is...
    Rule Low Severity
    Show

  • Disable Kernel Image Loading

    To set the runtime status of the <code>kernel.kexec_load_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kexec_load_disabled=1</pre> To make sure that the ...
    Rule Medium Severity
    Show

  • Disable loading and unloading of kernel modules

    To set the runtime status of the <code>kernel.modules_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.modules_disabled=1</pre> To make sure that the settin...
    Rule Medium Severity
    Show

  • Kernel panic on oops

    To set the runtime status of the <code>kernel.panic_on_oops</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.panic_on_oops=1</pre> To make sure that the setting is p...
    Rule Medium Severity
    Show

  • Limit CPU consumption of the Perf system

    To set the runtime status of the <code>kernel.perf_cpu_time_max_percent</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1</pre> To make su...
    Rule Medium Severity
    Show

  • Limit sampling frequency of the Perf system

    To set the runtime status of the <code>kernel.perf_event_max_sample_rate</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.perf_event_max_sample_rate=1</pre> To make ...
    Rule Medium Severity
    Show

  • Disallow kernel profiling by unprivileged users

    To set the runtime status of the <code>kernel.perf_event_paranoid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.perf_event_paranoid=2</pre> To make sure that the ...
    Rule Low Severity
    Show

  • Configure maximum number of process identifiers

    To set the runtime status of the <code>kernel.pid_max</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.pid_max=65536</pre> To make sure that the setting is persisten...
    Rule Medium Severity
    Show

  • Disable Access to Network bpf() Syscall From Unprivileged Processes

    To set the runtime status of the <code>kernel.unprivileged_bpf_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1</pre> To make su...
    Rule Medium Severity
    Show

  • Restrict usage of ptrace to descendant processes

    To set the runtime status of the <code>kernel.yama.ptrace_scope</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.yama.ptrace_scope=1</pre> To make sure that the sett...
    Rule Medium Severity
    Show

  • Harden the operation of the BPF just-in-time compiler

    To set the runtime status of the <code>net.core.bpf_jit_harden</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.core.bpf_jit_harden=2</pre> To make sure that the settin...
    Rule Medium Severity
    Show

  • Disable the use of user namespaces

    To set the runtime status of the <code>user.max_user_namespaces</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w user.max_user_namespaces=0</pre> To make sure that the set...
    Rule Medium Severity
    Show

  • Prevent applications from mapping low portion of virtual memory

    To set the runtime status of the <code>vm.mmap_min_addr</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w vm.mmap_min_addr=65536</pre> To make sure that the setting is persi...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules