Webstar/LibrePortal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge claude/1

Browse Source
This commit is contained in:
librelad 2026-05-23 22:59:18 +01:00
commit 5e8e28f33d
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
scripts/docker/install/rootless/rootless_docker.sh
View File

@ -209,6 +209,33 @@ EOL"
isSuccessful "Updated the sysctl with Docker Rootless configuration" isSuccessful "Updated the sysctl with Docker Rootless configuration"
fi fi
# Enabling unprivileged user namespaces (needed for rootless) widens the
# kernel attack surface reachable by unprivileged users. Offset that by
# closing the surfaces that local-privilege-escalation chains lean on:
# kptr_restrict hides kernel pointers (defeats info-leak primitives),
# ptrace_scope blocks cross-process ptrace (limits credential theft after
# a compromise), and bpf_jit_harden hardens the JIT against spraying.
# All three are distro-portable and have negligible runtime impact.
if ! grep -qF "# LIBREPORTAL KERNEL HARDENING START" "$sysctl"; then
local result=$(echo '# LIBREPORTAL KERNEL HARDENING START' | sudo tee -a "$sysctl" > /dev/null)
checkSuccess "Adding kernel hardening header to sysctl"
local result=$(echo 'kernel.kptr_restrict=2' | sudo tee -a "$sysctl" > /dev/null)
checkSuccess "Restricting kernel pointer exposure (kptr_restrict)"
local result=$(echo 'kernel.yama.ptrace_scope=1' | sudo tee -a "$sysctl" > /dev/null)
checkSuccess "Restricting cross-process ptrace (yama.ptrace_scope)"
local result=$(echo 'net.core.bpf_jit_harden=2' | sudo tee -a "$sysctl" > /dev/null)
checkSuccess "Hardening the BPF JIT (bpf_jit_harden)"
local result=$(echo '# LIBREPORTAL KERNEL HARDENING END' | sudo tee -a "$sysctl" > /dev/null)
checkSuccess "Adding kernel hardening end to sysctl"
isSuccessful "Applied kernel LPE-surface hardening"
fi
local result=$(sudo sysctl --system) local result=$(sudo sysctl --system)
checkSuccess "Applying changes to sysctl" checkSuccess "Applying changes to sysctl"