Skip to content

K
kernel-hardening-checker
Commit b69b6525 by Alexander Popov
Options

Add the 'fs.protected_fifos' check

parent aa8a28b3
Showing with 1 additions and 1 deletions
kernel_hardening_checker/checks.py
...@@ -580,7 +580,6 @@ def normalize_cmdline_options(option, value): ...@@ -580,7 +580,6 @@ def normalize_cmdline_options(option, value):
# TODO: draft of security hardening sysctls: # TODO: draft of security hardening sysctls:
# what about bpf_jit_enable? # what about bpf_jit_enable?
# vm.mmap_min_addr has a good value # vm.mmap_min_addr has a good value
# fs.protected_fifos=2
# fs.protected_regular=2 # fs.protected_regular=2
# fs.suid_dumpable=0 # fs.suid_dumpable=0
# kernel.modules_disabled=1 # kernel.modules_disabled=1
...@@ -616,3 +615,4 @@ def add_sysctl_checks(l, arch): ...@@ -616,3 +615,4 @@ def add_sysctl_checks(l, arch):
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_symlinks', '1')] l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_symlinks', '1')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_hardlinks', '1')] l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_hardlinks', '1')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_fifos', '2')]
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment