ansible/roles/basesecurity/templates/sysctl.d/local.conf.j2
2019-03-11 14:52:03 +01:00

17 lines
519 B
Django/Jinja

# {{ ansible_managed }}
# See https://www.ssi.gouv.fr/uploads/2016/01/linux_configuration-fr-v1.2.pdf
# Disable core dump of setuid executables
# So an user can't read privileged information in memory
fs.suid_dumpable = 0
# Obfuscate kernel memory addresses
kernel.kptr_restrict = 1
# Restrict dmesg access
# This can leak specific harware failures to exploit
kernel.dmesg_restrict = 1
# Do not load kernel modules after boot
# Some modules have security issues and are used in exploits
kernel.modules_disabled = 1