# Kernel and network hardening (Wren Linux parts/sysctl-hardening.sh), in the
# spirit of Kicksecure's security-misc. Debian already sets dmesg_restrict,
# unprivileged_bpf_disabled, perf_event_paranoid and protected_symlinks/
# hardlinks; this adds what is still open.

# Don't show kernel addresses to anyone, root included
kernel.kptr_restrict = 2
# A program may only trace its own children (no attaching gdb or strace to
# an already running program of yours without sudo)
kernel.yama.ptrace_scope = 1
# No loading a new kernel over the running one
kernel.kexec_load_disabled = 1
# Magic SysRq: off. The default lets anyone at the keyboard sync, remount, kill
# and reboot, and even the secure attention key alone would end a locked sway.
# REISUB needs 438 instead.
kernel.sysrq = 0
# No io_uring for anyone, root included (Kicksecure's setting). It is the
# kernel's newest way to do input and output, and where a large share of
# recent kernel exploits came from; Google switched it off in ChromeOS and
# Android for that reason. Nothing Wren Linux runs needs it: QEMU, the one
# program here that would use it, falls back to its older way by itself.
kernel.io_uring_disabled = 2
# Harden the BPF JIT against spraying attacks
net.core.bpf_jit_harden = 2
# Don't autoload obscure terminal line disciplines for ordinary users
dev.tty.ldisc_autoload = 0
# No core dumps from setuid programs
fs.suid_dumpable = 0
# Don't open files you don't own in world-writable folders, by accident
fs.protected_fifos = 2
fs.protected_regular = 2

# Refuse packets with a source address that couldn't come from that
# interface (2 = loose, which keeps VPNs working)
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2
# Ignore routing tricks a stranger on the network could try
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
# Survive SYN floods and don't be fooled by old TIME-WAIT packets
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1
# Don't answer pings, so a scan of a café's Wi-Fi doesn't find this laptop.
# ufw lets them in (Debian's /etc/ufw/before.rules); this keeps the kernel from
# replying, without editing ufw's own files. Pinging others still works.
net.ipv4.icmp_echo_ignore_all = 1
net.ipv6.icmp.echo_ignore_all = 1