File Permissions and Masks

$ sudo chmod +t DIR

$ sudo chmod 0640 /etc/audit/auditd.conf

$ sudo chmod 0640 /etc/audit/rules.d/*.rules

$ sudo chmod 0600 /boot/System.map-*

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null

$ sudo sysctl -w fs.protected_fifos=2

fs.protected_fifos = 2

$ sudo sysctl -w fs.protected_hardlinks=1

fs.protected_hardlinks = 1

$ sudo sysctl -w fs.protected_regular=2

fs.protected_regular = 2

$ sudo sysctl -w fs.protected_symlinks=1

fs.protected_symlinks = 1

$ sudo systemctl mask --now autofs.service

kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb

install cramfs /bin/true

install freevxfs /bin/true

install hfs /bin/true

install hfsplus /bin/true

install jffs2 /bin/true

install squashfs /bin/true

install udf /bin/true

install usb-storage /bin/true

install vfat /bin/true

0: Everybody may access all /proc/[pid] directories.
1: Users may not access files and subdirectories inside any /proc/[pid] directories
   but their own. The /proc/[pid] directories themselves remain visible.
2: Same as for mode 1, but in addition the /proc/[pid] directories belonging to other
   users become invisible.

/tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0

$ sudo sysctl -w kernel.core_pattern=|/bin/false

kernel.core_pattern = |/bin/false

$ sudo sysctl -w kernel.core_uses_pid=0

kernel.core_uses_pid = 0

$ sudo sysctl -w kernel.dmesg_restrict=1

kernel.dmesg_restrict = 1

$ sudo sysctl -w kernel.kexec_load_disabled=1

kernel.kexec_load_disabled = 1

$ sudo sysctl -w kernel.modules_disabled=1

kernel.modules_disabled = 1

$ sudo sysctl -w kernel.panic_on_oops=1

kernel.panic_on_oops = 1

$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1

kernel.perf_cpu_time_max_percent = 1

$ sudo sysctl -w kernel.perf_event_max_sample_rate=1

kernel.perf_event_max_sample_rate = 1

$ sudo sysctl -w kernel.perf_event_paranoid=2

kernel.perf_event_paranoid = 2

$ sudo sysctl -w kernel.pid_max=65536

kernel.pid_max = 65536

$ sudo sysctl -w kernel.sysrq=0

kernel.sysrq = 0

$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1

kernel.unprivileged_bpf_disabled = 1

$ sudo sysctl -w kernel.yama.ptrace_scope=1

kernel.yama.ptrace_scope = 1

$ sudo sysctl -w net.core.bpf_jit_harden=2

net.core.bpf_jit_harden = 2

$ sudo sysctl -w user.max_user_namespaces=0

user.max_user_namespaces = 0

$ sudo sysctl -w vm.mmap_min_addr=65536

vm.mmap_min_addr = 65536