Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set kernel.kptr_restrict = 2 #8746

Open
Tracked by #9249 ...
andrewrynhard opened this issue May 15, 2024 · 2 comments
Open
Tracked by #9249 ...

Set kernel.kptr_restrict = 2 #8746

andrewrynhard opened this issue May 15, 2024 · 2 comments

Comments

@andrewrynhard
Copy link
Member

The KSPP guidelines suggest using kernel.kptr_restrict = 2. Looks like we use kernel.kptr_restrict = 1.

I'm not sure what the implications are here just yet but wanted to point this out as we claim to adhere to KSPP guidelines but this one is wrong.

See https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings.

@steverfrancis
Copy link
Collaborator

steverfrancis commented May 16, 2024

Sysctls that changed
kernel.kptr_restrict = 2 (talos is set to 1)
kernel.yama.ptrace_scope = 3 (Talos is set to 1)

We do not set:
kernel.disable_modules = 1
kernel.kexec_load_disabled = 1 (I presume we do not want to, due to the special way we handle kexec, but we should document the exception)
kernel.randomize_va_space = 2
dev.tty.ldisc_autoload = 0
dev.tty.legacy_tiocsti = 0
kernel/warn_limit = 1 kernel/oops_limit = 1
vm.unprivileged_userfaultfd = 0

fs.protected_symlinks = 1
fs.protected_hardlinks = 1

fs.protected_fifos = 2
fs.protected_regular = 2

fs.suid_dumpable = 0

@steverfrancis
Copy link
Collaborator

Should go through all the other KSPP kernel and other settings too, to see if they need updating.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants