From d62895ee19bd032462a76b09faa696ac36a9edeb Mon Sep 17 00:00:00 2001 From: Hadi Chokr Date: Mon, 6 Jul 2026 05:46:22 +0200 Subject: [PATCH] Harden the kernel via sysctl Thanks secureblue! Related to https://invent.kde.org/kde-linux/kde-linux/-/work_items/660 --- .../lib/sysctl.d/11-kde-linux-default.conf | 9 ++- .../usr/lib/sysctl.d/55-hardening.conf | 66 +++++++++++++++++++ 2 files changed, 70 insertions(+), 5 deletions(-) create mode 100644 mkosi.extra/usr/lib/sysctl.d/55-hardening.conf diff --git a/mkosi.extra/usr/lib/sysctl.d/11-kde-linux-default.conf b/mkosi.extra/usr/lib/sysctl.d/11-kde-linux-default.conf index 1775141..90954bb 100644 --- a/mkosi.extra/usr/lib/sysctl.d/11-kde-linux-default.conf +++ b/mkosi.extra/usr/lib/sysctl.d/11-kde-linux-default.conf @@ -17,16 +17,15 @@ vm.watermark_scale_factor = 125 kernel.split_lock_mitigate = 0 # Not needed for us; disabling it increases speed and reduces power consumption kernel.nmi_watchdog = 0 -# Disable kexec as a security measure -kernel.kexec_load_disabled=1 # Use 'bbr' to achieve higher throughput when sending to high-latency destinations. # Also 'fq' to prevent one greedy app from causing lag (bufferbloat) for everything else. # `bbr` relies on pacing, and thus performs better with the `fq` qdisc. net.ipv4.tcp_congestion_control = bbr net.core.default_qdisc = fq -# Enable IPv6 privacy addressing by default -# KDE Linux is a desktop distribution. The Linux default of not having them is aimed at servers -net.ipv6.conf.default.use_tempaddr = 2 # Ensure that applications don't break/complain from hitting the limit fs.inotify.max_user_instances = 8192 fs.inotify.max_user_watches = 524288 +# Reboot 30s after a panic so an unattended machine recovers on its own. +# 30s, not -1: keeps the panic message readable and avoids a boot reboot-loop +# https://docs.kernel.org/admin-guide/sysctl/kernel.html#panic +kernel.panic=30 diff --git a/mkosi.extra/usr/lib/sysctl.d/55-hardening.conf b/mkosi.extra/usr/lib/sysctl.d/55-hardening.conf new file mode 100644 index 0000000..d352581 --- /dev/null +++ b/mkosi.extra/usr/lib/sysctl.d/55-hardening.conf @@ -0,0 +1,66 @@ +# SPDX-FileCopyrightText: Copyright 2025-2026 The Secureblue Authors +# SPDX-FileCopyrightText: Copyright 2026 Hadi Chokr +# +# SPDX-License-Identifier: Apache-2.0 +# + +# Drop RSTs that arrive during TIME-WAIT, closing the "TIME-WAIT assassination" +# hole where a stray or forged RST lets a new connection reuse the port too soon. +# https://docs.kernel.org/networking/ip-sysctl.html +# https://datatracker.ietf.org/doc/html/rfc1337 +net.ipv4.tcp_rfc1337 = 1 + +# Reverse-path filter: drop a packet if the kernel wouldn't route a reply back +# out the way it came, which defeats source-address spoofing. +# Loose mode (2), not strict (1): keeps VPNs and asymmetric routing working +# https://docs.kernel.org/networking/ip-sysctl.html +net.ipv4.conf.all.rp_filter = 2 + +# Only routers should emit ICMP redirects; a host doing so leaks topology and +# serves no purpose, so turn it off. +# https://docs.kernel.org/networking/ip-sysctl.html +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 +net.ipv4.conf.*.send_redirects = 0 + +# Refuse incoming ICMP redirects: accepting them lets anyone on the local segment +# rewrite our routing table and silently man-in-the-middle our traffic. +# https://docs.kernel.org/networking/ip-sysctl.html +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 +net.ipv4.conf.*.accept_redirects = 0 +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.default.accept_redirects = 0 +net.ipv6.conf.*.accept_redirects = 0 + +# IPv6 privacy extensions: use rotating temporary addresses for outbound traffic +# so connections can't be tied back to the stable, hardware-derived address. +# https://docs.kernel.org/networking/ip-sysctl.html +net.ipv6.conf.all.use_tempaddr = 2 +net.ipv6.conf.default.use_tempaddr = 2 + +# Log packets with impossible ("martian") source addresses so spoofing attempts +# leave a trail for monitoring and forensics. +# https://docs.kernel.org/networking/ip-sysctl.html +net.ipv4.conf.all.log_martians = 1 +net.ipv4.conf.default.log_martians = 1 + +# Keep the large, exploit-prone eBPF surface out of unprivileged hands; only +# privileged users can load BPF programs. +# https://docs.kernel.org/admin-guide/sysctl/kernel.html#unprivileged-bpf-disabled +kernel.unprivileged_bpf_disabled = 1 + +# Hide kernel pointers from everyone (even root) in /proc and friends, denying +# attackers the address leaks they need to defeat KASLR. +# https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict +kernel.kptr_restrict = 2 + +# Stop unprivileged users from auto-loading TTY line-discipline modules; several +# of those modules have shipped privilege-escalation bugs, so don't expose them. +# https://lkml.org/lkml/2019/4/15/890 +dev.tty.ldisc_autoload = 0 + +# Disable kexec so an attacker who reaches root still can't hot-swap the running +# kernel for a malicious one, bypassing Secure Boot and persisting stealthily. +# https://docs.kernel.org/admin-guide/sysctl/kernel.html#kexec-load-disabled +kernel.kexec_load_disabled = 1