From 4d5de9965b33f1eff1e15cb794fe0cfa734325fb Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sat, 27 May 2023 10:05:10 +0300 Subject: [PATCH] Add a comment about `kernel.unprivileged_userns_clone` sysctl in Debian --- kconfig_hardened_check/checks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kconfig_hardened_check/checks.py b/kconfig_hardened_check/checks.py index cda3df8..8e52fd8 100644 --- a/kconfig_hardened_check/checks.py +++ b/kconfig_hardened_check/checks.py @@ -16,7 +16,7 @@ This module contains knowledge for checks. # kernel.perf_event_paranoid=2 (or 3 with a custom patch, see https://lwn.net/Articles/696216/) # kernel.kexec_load_disabled=1 # kernel.yama.ptrace_scope=3 -# user.max_user_namespaces=0 +# user.max_user_namespaces=0 (for Debian, also see kernel.unprivileged_userns_clone) # what about bpf_jit_enable? # kernel.unprivileged_bpf_disabled=1 # net.core.bpf_jit_harden=2 -- 2.31.1