Restrict Programs from Dangerous Execution Patterns

$ sudo sysctl -w kernel.core_pattern=|/bin/false

kernel.core_pattern = |/bin/false

$ sudo sysctl -w kernel.core_uses_pid=0

kernel.core_uses_pid = 0

$ sudo sysctl -w kernel.dmesg_restrict=1

kernel.dmesg_restrict = 1

$ sudo sysctl -w kernel.kexec_load_disabled=1

kernel.kexec_load_disabled = 1

$ sudo sysctl -w kernel.modules_disabled=1

kernel.modules_disabled = 1

$ sudo sysctl -w kernel.panic_on_oops=1

kernel.panic_on_oops = 1

$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1

kernel.perf_cpu_time_max_percent = 1

$ sudo sysctl -w kernel.perf_event_max_sample_rate=1

kernel.perf_event_max_sample_rate = 1

$ sudo sysctl -w kernel.perf_event_paranoid=2

kernel.perf_event_paranoid = 2

$ sudo sysctl -w kernel.pid_max=65536

kernel.pid_max = 65536

$ sudo sysctl -w kernel.sysrq=0

kernel.sysrq = 0

$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1

kernel.unprivileged_bpf_disabled = 1

$ sudo sysctl -w kernel.yama.ptrace_scope=1

kernel.yama.ptrace_scope = 1

$ sudo sysctl -w net.core.bpf_jit_harden=2

net.core.bpf_jit_harden = 2

$ sudo sysctl -w user.max_user_namespaces=0

user.max_user_namespaces = 0

$ sudo sysctl -w vm.mmap_min_addr=65536

vm.mmap_min_addr = 65536