Skip to content

K
kernel-hardening-checker
Commit aa8a28b3 by Alexander Popov
Options

Add the 'fs.protected_hardlinks' check

parent 75d090b4
Showing with 1 additions and 1 deletions
kernel_hardening_checker/checks.py
...@@ -580,7 +580,6 @@ def normalize_cmdline_options(option, value): ...@@ -580,7 +580,6 @@ def normalize_cmdline_options(option, value):
# TODO: draft of security hardening sysctls: # TODO: draft of security hardening sysctls:
# what about bpf_jit_enable? # what about bpf_jit_enable?
# vm.mmap_min_addr has a good value # vm.mmap_min_addr has a good value
# fs.protected_hardlinks=1
# fs.protected_fifos=2 # fs.protected_fifos=2
# fs.protected_regular=2 # fs.protected_regular=2
# fs.suid_dumpable=0 # fs.suid_dumpable=0
...@@ -616,3 +615,4 @@ def add_sysctl_checks(l, arch): ...@@ -616,3 +615,4 @@ def add_sysctl_checks(l, arch):
# and since v5.11 it enables unprivileged userfaultfd for user-mode only. # and since v5.11 it enables unprivileged userfaultfd for user-mode only.
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_symlinks', '1')] l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_symlinks', '1')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_hardlinks', '1')]
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment