diff options
| author | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2014-06-26 17:45:45 -0300 |
|---|---|---|
| committer | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2014-06-26 17:45:45 -0300 |
| commit | aa41b0f81387ce2adb44aaddbb2cefbbb7473f5e (patch) | |
| tree | 1bce8d5a52b7103d496b86d6677c6a4c0a10aef8 /libre/linux-libre-grsec/sysctl.conf | |
| parent | 5e8fd240f188ba2ba339d9fcbf54d1adcbfae649 (diff) | |
| download | abslibre-aa41b0f81387ce2adb44aaddbb2cefbbb7473f5e.tar.gz abslibre-aa41b0f81387ce2adb44aaddbb2cefbbb7473f5e.tar.bz2 abslibre-aa41b0f81387ce2adb44aaddbb2cefbbb7473f5e.zip | |
linux-libre-grsec-3.15.1.201406222112-3: updating revision
* enable container-compatible chroot restrictions by default
* add missing module
Diffstat (limited to 'libre/linux-libre-grsec/sysctl.conf')
| -rw-r--r-- | libre/linux-libre-grsec/sysctl.conf | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/libre/linux-libre-grsec/sysctl.conf b/libre/linux-libre-grsec/sysctl.conf index ebd4dd574..a5f6bf83e 100644 --- a/libre/linux-libre-grsec/sysctl.conf +++ b/libre/linux-libre-grsec/sysctl.conf @@ -44,21 +44,21 @@ kernel.grsecurity.fifo_restrictions = 1 #kernel.grsecurity.romount_protect = 1 # -# chroot restrictions (many of these will break containers) +# chroot restrictions (the commented options will break containers) # #kernel.grsecurity.chroot_caps = 1 #kernel.grsecurity.chroot_deny_chmod = 1 #kernel.grsecurity.chroot_deny_chroot = 1 -#kernel.grsecurity.chroot_deny_fchdir = 1 +kernel.grsecurity.chroot_deny_fchdir = 1 #kernel.grsecurity.chroot_deny_mknod = 1 #kernel.grsecurity.chroot_deny_mount = 1 #kernel.grsecurity.chroot_deny_pivot = 1 -#kernel.grsecurity.chroot_deny_shmat = 1 -#kernel.grsecurity.chroot_deny_sysctl = 1 -#kernel.grsecurity.chroot_deny_unix = 1 +kernel.grsecurity.chroot_deny_shmat = 1 +kernel.grsecurity.chroot_deny_sysctl = 1 +kernel.grsecurity.chroot_deny_unix = 1 kernel.grsecurity.chroot_enforce_chdir = 1 -#kernel.grsecurity.chroot_findtask = 1 +kernel.grsecurity.chroot_findtask = 1 #kernel.grsecurity.chroot_restrict_nice = 1 # |