blob: f32a9e6c4b3c31031a288bcfcbafa412f66c12b5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
#
# Copyright 1999-2007 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: $
#
# Created by Wolfram Schlich <wschlich@gentoo.org>
# Feedback is greatly appreciated!
#
##
## GRsecurity sysctl options
##
#
# Misc Restrictions
#
#kernel.grsecurity.execve_limiting = 1
#kernel.grsecurity.fifo_restrictions = 1
#kernel.grsecurity.linking_restrictions = 1
#kernel.grsecurity.dmesg = 1
#
# Misc Protections
#
#kernel.grsecurity.destroy_unused_shm = 1
#
# Socket Restrictions
#
#kernel.grsecurity.socket_server_gid = 1002
#kernel.grsecurity.socket_server = 1
#kernel.grsecurity.socket_client_gid = 1003
#kernel.grsecurity.socket_client = 1
#kernel.grsecurity.socket_all_gid = 1004
#kernel.grsecurity.socket_all = 1
#
# Trusted Path Execution
#
#kernel.grsecurity.tpe_gid = 1005
#kernel.grsecurity.tpe = 1
#
# Chroot Restrictions
#
#kernel.grsecurity.chroot_findtask = 1
#kernel.grsecurity.chroot_deny_sysctl = 1
#kernel.grsecurity.chroot_caps = 1
#kernel.grsecurity.chroot_execlog = 1
#kernel.grsecurity.chroot_restrict_nice = 1
#kernel.grsecurity.chroot_deny_mknod = 1
#kernel.grsecurity.chroot_deny_chmod = 1
#kernel.grsecurity.chroot_enforce_chdir = 1
#kernel.grsecurity.chroot_deny_pivot = 1
#kernel.grsecurity.chroot_deny_chroot = 1
#kernel.grsecurity.chroot_deny_fchdir = 1
#kernel.grsecurity.chroot_deny_mount = 1
#kernel.grsecurity.chroot_deny_unix = 1
#kernel.grsecurity.chroot_deny_shmat = 1
#
# Auditing & Logging
#
kernel.grsecurity.audit_ipc = 1
kernel.grsecurity.audit_mount = 1
kernel.grsecurity.forkfail_logging = 1
kernel.grsecurity.resource_logging = 1
kernel.grsecurity.signal_logging = 1
kernel.grsecurity.timechange_logging = 1
#
# Disable the loading of modules
#
#kernel.grsecurity.disable_modules = 1
#
# Finally lock the sysctl settings
#
#kernel.grsecurity.grsec_lock = 1
|
GitWeb