This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 65650ec69be35b5372a7fdca3e74deb3fd433327 (commit) via ef21f3e49d2998eb4a223c05ef05f169ae99537a (commit) from 4cd82be05f21bcf49e38793e41730923a0107a0b (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 65650ec69be35b5372a7fdca3e74deb3fd433327 Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Jul 4 11:21:42 2019 +0100

core135: Ship updated sysctl.conf

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit ef21f3e49d2998eb4a223c05ef05f169ae99537a Author: Peter Müller peter.mueller@ipfire.org Date: Thu Jul 4 19:15:00 2019 +0000

sysctl: improve KASLR effectiveness for mmap

By feeding more random bits into mmap allocation, the effectiveness of KASLR will be improved, making attacks trying to bypass address randomisation more difficult.

Changed sysctl values are:

vm.mmap_rnd_bits = 32 (default: 28) vm.mmap_rnd_compat_bits = 16 (default: 8)

Signed-off-by: Peter Müller peter.mueller@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/etc/sysctl.conf | 4 ++++ config/rootfiles/core/135/filelists/files | 1 + 2 files changed, 5 insertions(+)

Difference in files: diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 9a943fffa..5a67f1795 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -45,6 +45,10 @@ kernel.kptr_restrict = 2 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1

+# Improve KASLR effectiveness for mmap +vm.mmap_rnd_bits = 32 +vm.mmap_rnd_compat_bits = 16 + # Minimal preemption granularity for CPU-bound tasks: # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) kernel.sched_min_granularity_ns = 10000000 diff --git a/config/rootfiles/core/135/filelists/files b/config/rootfiles/core/135/filelists/files index 50bf616b0..7cf3741c5 100644 --- a/config/rootfiles/core/135/filelists/files +++ b/config/rootfiles/core/135/filelists/files @@ -7,3 +7,4 @@ etc/rc.d/init.d/cloud-init etc/rc.d/init.d/functions etc/rc.d/init.d/partresize etc/rc.d/init.d/unbound +etc/sysctl.conf

hooks/post-receive -- IPFire 2.x development tree