Restrict Programs from Dangerous Execution Patterns

$ sudo sysctl -w kernel.dmesg_restrict=1

kernel.dmesg_restrict = 1

$ sudo sysctl -w kernel.kexec_load_disabled=1

kernel.kexec_load_disabled = 1

$ sudo sysctl -w kernel.modules_disabled=1

kernel.modules_disabled = 1

$ sudo sysctl -w kernel.panic_on_oops=1

kernel.panic_on_oops = 1

$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1

kernel.perf_cpu_time_max_percent = 1

$ sudo sysctl -w kernel.perf_event_max_sample_rate=1

kernel.perf_event_max_sample_rate = 1

$ sudo sysctl -w kernel.perf_event_paranoid=2

kernel.perf_event_paranoid = 2

$ sudo sysctl -w kernel.pid_max=65536

kernel.pid_max = 65536

$ sudo sysctl -w kernel.sysrq=0

kernel.sysrq = 0

$ sudo sysctl -w kernel.yama.ptrace_scope=1

kernel.yama.ptrace_scope = 1

$ sudo sysctl -w vm.mmap_min_addr=65536

vm.mmap_min_addr = 65536