make /boot and /lib/modules unreadable for non-root users

[phabricator-migrator]

Information

ID: 937
PHID: PHID-TASK-npy4o5xtllrng6w4r7ci
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Kernel Hardening - security-misc

Good point. Here is a related bug report: Summary: Ubuntu seems to harden this already. Kees Cook (kees) wrote on 2011-04-25: #3 This mode change is “by design”. For local admins that what to relax this restriction, you can use dpkg-statoverride: sudo dpkg-statoverride --add root root 0644 /boot/vmlinuz-$(uname -r) --update To have this automatically happen with each new kernel, create /etc/kernel/postinst.d/statoverride: . #!/bin/sh version="$1" # passing the kernel version is re…

Comments

---

madaidan

2019-12-23 20:26:52 UTC

---

madaidan

2019-12-23 20:29:03 UTC

Make /lib/modules unreadable by madaidan · Pull Request #50 · Kicksecure/security-misc · GitHub