Harden the kernel via sysctl

Thanks secureblue!

Related to https://invent.kde.org/kde-linux/kde-linux/-/work_items/660

mkosi.extra/usr/lib/sysctl.d/11-kde-linux-default.conf

@@ -17,16 +17,15 @@ vm.watermark_scale_factor = 125
 kernel.split_lock_mitigate = 0
 # Not needed for us; disabling it increases speed and reduces power consumption
 kernel.nmi_watchdog = 0
-# Disable kexec as a security measure
-kernel.kexec_load_disabled=1
 # Use 'bbr' to achieve higher throughput when sending to high-latency destinations.
 # Also 'fq' to prevent one greedy app from causing lag (bufferbloat) for everything else.
 # `bbr` relies on pacing, and thus performs better with the `fq` qdisc.
 net.ipv4.tcp_congestion_control = bbr
 net.core.default_qdisc = fq
-# Enable IPv6 privacy addressing by default
-# KDE Linux is a desktop distribution. The Linux default of not having them is aimed at servers
-net.ipv6.conf.default.use_tempaddr = 2
 # Ensure that applications don't break/complain from hitting the limit
 fs.inotify.max_user_instances = 8192
 fs.inotify.max_user_watches = 524288
+# Reboot 30s after a panic so an unattended machine recovers on its own.
+# 30s, not -1: keeps the panic message readable and avoids a boot reboot-loop
+# https://docs.kernel.org/admin-guide/sysctl/kernel.html#panic
+kernel.panic=30

mkosi.extra/usr/lib/sysctl.d/55-hardening.conf

@@ -0,0 +1,66 @@
+# SPDX-FileCopyrightText: Copyright 2025-2026 The Secureblue Authors
+# SPDX-FileCopyrightText: Copyright 2026 Hadi Chokr <hadichokr@icloud.com>
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+# Drop RSTs that arrive during TIME-WAIT, closing the "TIME-WAIT assassination"
+# hole where a stray or forged RST lets a new connection reuse the port too soon.
+# https://docs.kernel.org/networking/ip-sysctl.html
+# https://datatracker.ietf.org/doc/html/rfc1337
+net.ipv4.tcp_rfc1337 = 1
+
+# Reverse-path filter: drop a packet if the kernel wouldn't route a reply back
+# out the way it came, which defeats source-address spoofing.
+# Loose mode (2), not strict (1): keeps VPNs and asymmetric routing working
+# https://docs.kernel.org/networking/ip-sysctl.html
+net.ipv4.conf.all.rp_filter = 2
+
+# Only routers should emit ICMP redirects; a host doing so leaks topology and
+# serves no purpose, so turn it off.
+# https://docs.kernel.org/networking/ip-sysctl.html
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.*.send_redirects = 0
+
+# Refuse incoming ICMP redirects: accepting them lets anyone on the local segment
+# rewrite our routing table and silently man-in-the-middle our traffic.
+# https://docs.kernel.org/networking/ip-sysctl.html
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.*.accept_redirects = 0
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+net.ipv6.conf.*.accept_redirects = 0
+
+# IPv6 privacy extensions: use rotating temporary addresses for outbound traffic
+# so connections can't be tied back to the stable, hardware-derived address.
+# https://docs.kernel.org/networking/ip-sysctl.html
+net.ipv6.conf.all.use_tempaddr = 2
+net.ipv6.conf.default.use_tempaddr = 2
+
+# Log packets with impossible ("martian") source addresses so spoofing attempts
+# leave a trail for monitoring and forensics.
+# https://docs.kernel.org/networking/ip-sysctl.html
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+
+# Keep the large, exploit-prone eBPF surface out of unprivileged hands; only
+# privileged users can load BPF programs.
+# https://docs.kernel.org/admin-guide/sysctl/kernel.html#unprivileged-bpf-disabled
+kernel.unprivileged_bpf_disabled = 1
+
+# Hide kernel pointers from everyone (even root) in /proc and friends, denying
+# attackers the address leaks they need to defeat KASLR.
+# https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict
+kernel.kptr_restrict = 2
+
+# Stop unprivileged users from auto-loading TTY line-discipline modules; several
+# of those modules have shipped privilege-escalation bugs, so don't expose them.
+# https://lkml.org/lkml/2019/4/15/890
+dev.tty.ldisc_autoload = 0
+
+# Disable kexec so an attacker who reaches root still can't hot-swap the running
+# kernel for a malicious one, bypassing Secure Boot and persisting stealthily.
+# https://docs.kernel.org/admin-guide/sysctl/kernel.html#kexec-load-disabled
+kernel.kexec_load_disabled = 1