From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] hide kernel addresses in /proc against privileged users
Date: Mon, 21 Jan 2019 10:17:42 +0000
Message-ID: <B2B43E94-7188-46F9-AD19-5D2F1E1D9EC6@ipfire.org>
In-Reply-To: <015ae288-bd5a-15c1-151a-3189d769a984@link38.eu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1305193522203477150=="
List-Id: <development.lists.ipfire.org>

--===============1305193522203477150==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello,

Please increment the release number of this package.

Best,
-Michael

> On 20 Jan 2019, at 17:03, Peter M=C3=BCller <peter.mueller(a)link38.eu> wro=
te:
>=20
> In order to make local privilege escalation more harder, hide
> kernel addresses in various /proc files against users with
> root (or similar) permissions, too.
>=20
> Common system hardening tools such as lynis recommend this.
>=20
> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
> ---
> setup/sysctl/kernel-hardening.conf | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>=20
> diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-harde=
ning.conf
> index 6751bbef6..9bb6e9f45 100644
> --- a/setup/sysctl/kernel-hardening.conf
> +++ b/setup/sysctl/kernel-hardening.conf
> @@ -1,5 +1,5 @@
> # Try to keep kernel address exposures out of various /proc files (kallsyms=
, modules, etc).
> -kernel.kptr_restrict =3D 1
> +kernel.kptr_restrict =3D 2
>=20
> # Avoid kernel memory address exposures via dmesg.
> kernel.dmesg_restrict =3D 1
> --=20
> 2.16.4


--===============1305193522203477150==--