kernel recompilation for better hardening

[madaidan]

@Patrick

I see. I don’t remember discussing patching out dmesg though.

AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

It might be better to just fix this directly in the kernel with a patch adding a kernel.dmesg_restrict=2 sysctl rather than trying to hack our way around it.

@Patrick

Would it suffice to prohibit executing dmesg using apparmor-profile-everything for all users except superroot?

That doesn’t stop the attacker from using their own program. They can copy/paste the dmesg source code.