This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree".

The branch, master has been updated via 5c62e4739107a7bb167c31c0f353f1ff8a150f2d (commit) from 26707c0aeb54d8ab47c5e684ef99367e73834e19 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 5c62e4739107a7bb167c31c0f353f1ff8a150f2d Author: Peter Müller peter.mueller@link38.eu Date: Thu Jan 3 18:05:40 2019 +0100

prevent kernel address space leak via dmesg or /proc files

Enable runtime sysctl hardening in order to avoid kernel addresses being disclosed via dmesg (in case it was built in without restrictions) or various /proc files.

See https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommende... for further information.

Signed-off-by: Peter Müller peter.mueller@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: setup/setup.nm | 4 +++- setup/sysctl/kernel-hardening.conf | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 setup/sysctl/kernel-hardening.conf

Difference in files: diff --git a/setup/setup.nm b/setup/setup.nm index 78d1a5df3..e79fff10d 100644 --- a/setup/setup.nm +++ b/setup/setup.nm @@ -5,7 +5,7 @@

name = setup version = 3.0 -release = 10 +release = 11 arch = noarch

groups = Base Build System/Base @@ -53,6 +53,8 @@ build %{BUILDROOT}%{sysconfdir}/sysctl.d/printk.conf install -m 644 %{DIR_APP}/sysctl/swappiness.conf \ %{BUILDROOT}%{sysconfdir}/sysctl.d/swappiness.conf + install -m 644 %{DIR_APP}/sysctl/kernel-hardening.conf \ + %{BUILDROOT}%{sysconfdir}/sysctl.d/kernel-hardening.conf end end

diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf new file mode 100644 index 000000000..6751bbef6 --- /dev/null +++ b/setup/sysctl/kernel-hardening.conf @@ -0,0 +1,6 @@ +# Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). +kernel.kptr_restrict = 1 + +# Avoid kernel memory address exposures via dmesg. +kernel.dmesg_restrict = 1 +

hooks/post-receive -- IPFire 3.x development tree