An XCCDF Group - A logical subset of the XCCDF Benchmark
kernel.panic_on_oops
$ sudo sysctl -w kernel.panic_on_oops=1
/etc/sysctl.d
kernel.panic_on_oops = 1
/etc/security/limits.conf
/etc/security/limits.d/
limits.conf
sysctl
fs.suid_dumpable
ProcessSizeMax
[Coredump]
/etc/systemd/coredump.conf
Storage
none
$ sudo sysctl -w fs.suid_dumpable=0
fs.suid_dumpable = 0
kernel.exec-shield
kernel.randomize_va_space
kernel.kptr_restrict
$ sudo sysctl -w kernel.kptr_restrict=
kernel.kptr_restrict =
$ sudo sysctl -w kernel.randomize_va_space=2
kernel.randomize_va_space = 2
kernel-PAE
$ apt-get install kernel-PAE
/etc/default/grub
slub_debug
page_poison=1
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) page_poison=1"
slub_debug=
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) slub_debug="
kernel.dmesg_restrict
$ sudo sysctl -w kernel.dmesg_restrict=1
kernel.dmesg_restrict = 1
kernel.modules_disabled
$ sudo sysctl -w kernel.modules_disabled=1
kernel.modules_disabled = 1
kernel.perf_cpu_time_max_percent
$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1
kernel.perf_cpu_time_max_percent = 1
kernel.perf_event_max_sample_rate
$ sudo sysctl -w kernel.perf_event_max_sample_rate=1
kernel.perf_event_max_sample_rate = 1
kernel.perf_event_paranoid
$ sudo sysctl -w kernel.perf_event_paranoid=2
kernel.perf_event_paranoid = 2
kernel.pid_max
$ sudo sysctl -w kernel.pid_max=65536
kernel.pid_max = 65536
kernel.sysrq
$ sudo sysctl -w kernel.sysrq=0
kernel.sysrq = 0
kernel.unprivileged_bpf_disabled
$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1
kernel.unprivileged_bpf_disabled = 1
kernel.yama.ptrace_scope
$ sudo sysctl -w kernel.yama.ptrace_scope=1
kernel.yama.ptrace_scope = 1
net.core.bpf_jit_harden
$ sudo sysctl -w net.core.bpf_jit_harden=2
net.core.bpf_jit_harden = 2
vm.mmap_min_addr
$ sudo sysctl -w vm.mmap_min_addr=65536
vm.mmap_min_addr = 65536