From: Alexander Popov Date: Sat, 27 May 2023 07:05:10 +0000 (+0300) Subject: Add a comment about `kernel.unprivileged_userns_clone` sysctl in Debian X-Git-Tag: v0.6.6~154 X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=4d5de9965b33f1eff1e15cb794fe0cfa734325fb;p=kconfig-hardened-check.git Add a comment about `kernel.unprivileged_userns_clone` sysctl in Debian --- diff --git a/kconfig_hardened_check/checks.py b/kconfig_hardened_check/checks.py index cda3df8..8e52fd8 100644 --- a/kconfig_hardened_check/checks.py +++ b/kconfig_hardened_check/checks.py @@ -16,7 +16,7 @@ This module contains knowledge for checks. # kernel.perf_event_paranoid=2 (or 3 with a custom patch, see https://lwn.net/Articles/696216/) # kernel.kexec_load_disabled=1 # kernel.yama.ptrace_scope=3 -# user.max_user_namespaces=0 +# user.max_user_namespaces=0 (for Debian, also see kernel.unprivileged_userns_clone) # what about bpf_jit_enable? # kernel.unprivileged_bpf_disabled=1 # net.core.bpf_jit_harden=2