Kernel Hardening - security-misc

No, it’s just stuff we’ve already enabled or unneeded things. Some of these options are defaults so I don’t know why they’re in this package.

kaslr

KASLR is enabled by default in Debian and most other distros.

kernel.perf_event_paranoid = 3

This is a default in Debian and requires a kernel patch so we can’t set it in security-misc for other distros since they might not have the patch.

user.max_user_namespaces = 0

Disabling user namespaces entirely will break many sandboxing applications and won’t give any benefit. User namespaces do add a lot of attack surface for privilege escalation but as Debian disables it for unprivileged users by default with a kernel patch, disabling them entirely is pointless.

If all relevant modules have been loaded in the initramfs (by listing them in /etc/initramfs/modules and rebuilding the initramfs with update-initramfs, one can completely disable modules loading with:

This is interesting though. It might be another way to load kernel modules for enforce kernel module software signature verification [module signing] / disallow kernel module loading by default

2 Likes