andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix duplicate sysctl config (#505)

Browse Source 
Signed-off-by: tekicat <[email protected]>
Signed-off-by: gk <[email protected]>
Signed-off-by: Tekicat <[email protected]>
This commit is contained in:
tekicat authored and GitHub committed 2021-11-26 11:30:50 +01:00
1 parent b67a28bd09
commit 88893a5d4a
1 file changed
+6 -10
Download Patch File Download Diff File Expand all files Collapse all files
roles/os_hardening/defaults/main.yml
+6 -10
View File
@@ -69,6 +69,12 @@ sysctl_config:
# filenames (generally seen as "/tmp file race" vulnerabilities). # filenames (generally seen as "/tmp file race" vulnerabilities).
fs.protected_hardlinks: 1 fs.protected_hardlinks: 1
fs.protected_symlinks: 1 fs.protected_symlinks: 1
# For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
# Restrict FIFO special device creation behavior
fs.protected_fifos: 1
# Restrict regular files creation behavior
fs.protected_regular: 2
# Prevent core dumps with SUID. These are usually only # Prevent core dumps with SUID. These are usually only
# needed by developers and may contain sensitive information. | sysctl-31 # needed by developers and may contain sensitive information. | sysctl-31
@@ -290,16 +296,6 @@ sysctl_config:
# Mitigates CVE-2021-33909 and other exploits. # Mitigates CVE-2021-33909 and other exploits.
kernel.unprivileged_userns_clone: 0 kernel.unprivileged_userns_clone: 0
# For more info on the following settings see: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html
# Restrict FIFO special device creation behavior
fs.protected_fifos: 1
# Restrict hardlink creation behavior
fs.protected_hardlinks: 1
# Restrict regular files creation behavior
fs.protected_regular: 2
# Restrict symlink following behavior
fs.protected_symlinks: 1
# Do not delete the following line or otherwise the playbook will fail # Do not delete the following line or otherwise the playbook will fail
# at task 'create a combined sysctl-dict if overwrites are defined' # at task 'create a combined sysctl-dict if overwrites are defined'
sysctl_overwrite: sysctl_overwrite: