File Permissions and Masks

$ sudo chmod +t DIR
        

/bin 
/sbin 
/usr/bin 
/usr/sbin 
/usr/local/bin 
/usr/local/sbin

$ sudo chgrp root DIR
        

/bin 
/sbin 
/usr/bin 
/usr/sbin 
/usr/local/bin 
/usr/local/sbin

$ sudo chown root DIR
        

$ sudo chgrp root /etc/crypttab

$ sudo chgrp root /boot/System.map*

$ sudo chown root /etc/crypttab 

$ sudo chown root /boot/System.map* 

$ sudo chmod 0600 /etc/crypttab

$ sudo chmod 0600 /boot/System.map*

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null

$ sudo sysctl -w fs.protected_fifos=2

fs.protected_fifos = 2

$ sudo sysctl -w fs.protected_hardlinks=1

fs.protected_hardlinks = 1

$ sudo sysctl -w fs.protected_regular=2

fs.protected_regular = 2

$ sudo sysctl -w fs.protected_symlinks=1

fs.protected_symlinks = 1

$ sudo sysctl -w kernel.dmesg_restrict=1

kernel.dmesg_restrict = 1

$ sudo sysctl -w kernel.modules_disabled=1

kernel.modules_disabled = 1

$ sudo sysctl -w kernel.panic_on_oops=1

kernel.panic_on_oops = 1

$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1

kernel.perf_cpu_time_max_percent = 1

$ sudo sysctl -w kernel.perf_event_max_sample_rate=1

kernel.perf_event_max_sample_rate = 1

$ sudo sysctl -w kernel.perf_event_paranoid=2

kernel.perf_event_paranoid = 2

$ sudo sysctl -w kernel.pid_max=65536

kernel.pid_max = 65536

$ sudo sysctl -w kernel.sysrq=0

kernel.sysrq = 0

$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1

kernel.unprivileged_bpf_disabled = 1

$ sudo sysctl -w kernel.yama.ptrace_scope=1

kernel.yama.ptrace_scope = 1

$ sudo sysctl -w net.core.bpf_jit_harden=2

net.core.bpf_jit_harden = 2

$ sudo sysctl -w vm.mmap_min_addr=65536

vm.mmap_min_addr = 65536