mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-07-22 13:51:50 +07:00
Code Issues Packages Projects Releases Wiki Activity

Provide option to disable user namespaces

Browse Source
This commit is contained in:
Raja Grewal
2024-08-16 22:54:57 +10:00
parent e962153f84
commit 759aee8150
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -93,11 +93,16 @@ kernel.sysrq=0
## User namespaces aim to improve sandboxing and accessibility for unprivileged users.
## Unprivileged user namespaces pose substantial privilege escalation risks.
## Restricting may lead to breakages in numerous software packages.
## Uncomment the second sysctl to entirely disable user namespaces.
##
## https://madaidans-insecurities.github.io/linux.html#kernel
## https://github.com/a13xp0p0v/kernel-hardening-checker#questions-and-answers
##
## KSPP=partial
## KSPP sets the stricter sysctl user.max_user_namespaces=0.
##
kernel.unprivileged_userns_clone=0
#user.max_user_namespaces=0
## Restricts kernel profiling to users with CAP_PERFMON.
## The performance events system should not be accessible by unprivileged users.