move sysctls to debian specific vars (#524)

* fix ansible-lint issue https://github.com/ansible-community/ansible-lint/issues/1795 Signed-off-by: rndmh3ro <[email protected]> * move 2 sysctls to debian specific Signed-off-by: rndmh3ro <[email protected]> * fix ansible-lint issue https://github.com/ansible-community/ansible-lint/issues/1795 Signed-off-by: rndmh3ro <[email protected]> * add arch linux sysctls * simplify sysctl settings Signed-off-by: rndmh3ro <[email protected]> * ove overwrite to the bottom to let it acutally overwrite something Signed-off-by: rndmh3ro <[email protected]> * fix typo Signed-off-by: rndmh3ro <[email protected]>
2022-02-18 15:30:32 +01:00
1 parent 798f4b9a99
commit 2ba40b0891
@@ -69,7 +69,7 @@ sysctl_config:
  # filenames (generally seen as "/tmp file race" vulnerabilities).
  fs.protected_hardlinks: 1
  fs.protected_symlinks: 1
-  
+
  # For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
  # Restrict FIFO special device creation behavior
  fs.protected_fifos: 1
@@ -288,14 +288,6 @@ sysctl_config:
  vm.mmap_rnd_bits: 32
  vm.mmap_rnd_compat_bits: 16

-  # Disable unprivileged users from loading eBPF programs into the kernel.
-  # One of mitigations against CVE-2021-33909. | Tail-2
-  kernel.unprivileged_bpf_disabled: 1
-
-  # Reduce attack surface by disabling unprivileged user namespaces.
-  # Mitigates CVE-2021-33909 and other exploits.
-  kernel.unprivileged_userns_clone: 0
-
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite: