[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 65650ec69be35b5372a7fdca3e74deb3fd433327

[Michael Tremer <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2795 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  65650ec69be35b5372a7fdca3e74deb3fd433327 (commit)
       via  ef21f3e49d2998eb4a223c05ef05f169ae99537a (commit)
      from  4cd82be05f21bcf49e38793e41730923a0107a0b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 65650ec69be35b5372a7fdca3e74deb3fd433327
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Jul 4 11:21:42 2019 +0100

    core135: Ship updated sysctl.conf
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit ef21f3e49d2998eb4a223c05ef05f169ae99537a
Author: Peter Müller <peter.mueller(a)ipfire.org>
Date:   Thu Jul 4 19:15:00 2019 +0000

    sysctl: improve KASLR effectiveness for mmap
    
    By feeding more random bits into mmap allocation, the
    effectiveness of KASLR will be improved, making attacks
    trying to bypass address randomisation more difficult.
    
    Changed sysctl values are:
    
    vm.mmap_rnd_bits = 32 (default: 28)
    vm.mmap_rnd_compat_bits = 16 (default: 8)
    
    Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/etc/sysctl.conf                    | 4 ++++
 config/rootfiles/core/135/filelists/files | 1 +
 2 files changed, 5 insertions(+)

Difference in files:
diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
index 9a943fffa..5a67f1795 100644
--- a/config/etc/sysctl.conf
+++ b/config/etc/sysctl.conf
@@ -45,6 +45,10 @@ kernel.kptr_restrict = 2
 # Avoid kernel memory address exposures via dmesg.
 kernel.dmesg_restrict = 1
 
+# Improve KASLR effectiveness for mmap
+vm.mmap_rnd_bits = 32
+vm.mmap_rnd_compat_bits = 16
+
 # Minimal preemption granularity for CPU-bound tasks:
 # (default: 1 msec#  (1 + ilog(ncpus)), units: nanoseconds)
 kernel.sched_min_granularity_ns = 10000000
diff --git a/config/rootfiles/core/135/filelists/files b/config/rootfiles/core/135/filelists/files
index 50bf616b0..7cf3741c5 100644
--- a/config/rootfiles/core/135/filelists/files
+++ b/config/rootfiles/core/135/filelists/files
@@ -7,3 +7,4 @@ etc/rc.d/init.d/cloud-init
 etc/rc.d/init.d/functions
 etc/rc.d/init.d/partresize
 etc/rc.d/init.d/unbound
+etc/sysctl.conf


hooks/post-receive
--
IPFire 2.x development tree