Hi Thomas,
Thanks for your prompt helpful response.
sudo journalctl -u systemd-sysctl.service -b
returned:
Jul 09 08:14:30 Desktop systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
Jul 09 08:14:30 Desktop systemd[1]: systemd-sysctl.service: Main process exited, code=exited, status=1/FAILURE
Jul 09 08:14:30 Desktop systemd[1]: systemd-sysctl.service: Failed with result 'exit-code'.
Jul 09 08:14:30 Desktop systemd[1]: Failed to start systemd-sysctl.service - Apply Kernel Variables.
Jul 09 08:14:31 Desktop systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
Jul 09 08:14:31 Desktop systemd[1]: systemd-sysctl.service: Main process exited, code=exited, status=1/FAILURE
Jul 09 08:14:31 Desktop systemd[1]: systemd-sysctl.service: Failed with result 'exit-code'.
Jul 09 08:14:31 Desktop systemd[1]: Failed to start systemd-sysctl.service - Apply Kernel Variables.
/usr/lib/systemd/systemd-sysctl --tldr
returned:
# /usr/lib/sysctl.d/10-default-yama-scope.conf
kernel.yama.ptrace_scope = 0
# /usr/lib/sysctl.d/10-map-count.conf
vm.max_map_count=1048576
# /usr/lib/sysctl.d/50-coredump.conf
kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %d %F
kernel.core_pipe_limit=16
fs.suid_dumpable=2
# /usr/lib/sysctl.d/50-default.conf
kernel.sysrq = 16
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.*.rp_filter = 2
-net.ipv4.conf.all.rp_filter
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.*.accept_source_route = 0
-net.ipv4.conf.all.accept_source_route
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.*.promote_secondaries = 1
-net.ipv4.conf.all.promote_secondaries
-net.ipv4.ping_group_range = 0 2147483647
-net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_regular = 1
fs.protected_fifos = 1
# /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf
net.core.optmem_max = 81920
# /usr/lib/sysctl.d/50-libreswan.conf
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
# /usr/lib/sysctl.d/50-pid-max.conf
kernel.pid_max = 4194304
# /etc/sysctl.d/99-cfg-hardening.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
lines 1-50
/usr/lib/systemd/systemd-sysctl --cat-config
returned:
/usr/lib/sysctl.d/10-default-yama-scope.conf
# When yama is enabled in the kernel it might be used to filter any user
# space access which requires PTRACE_MODE_ATTACH like ptrace attach, access
# to /proc/PID/{mem,personality,stack,syscall}, and the syscalls
# process_vm_readv and process_vm_writev which are used for interprocess
# services, communication and introspection (like synchronisation, signaling,
# debugging, tracing and profiling) of processes.
#
# Usage of ptrace attach is restricted by normal user permissions. Normal
# unprivileged processes cannot interact through ptrace with processes
# that they cannot send signals to or processes that are running set-uid
# or set-gid.
#
# yama ptrace scope can be used to reduce these permissions even more.
# This should normally not be done because it will break various programs
# relying on the default ptrace security restrictions. But can be used
# if you don't have any other way to separate processes in their own
# domains. A different way to restrict ptrace is to set the selinux
# deny_ptrace boolean. Both mechanisms will break some programs relying
# on the ptrace system call and might force users to elevate their
# privileges to root to do their work.
#
# For more information see Documentation/security/Yama.txt in the kernel
/usr/lib/systemd/systemd-sysctl --strict
returned:
/etc/sysctl.d/99-cfg-hardening.conf:50: Line is not an assignment, ignoring: EOF
Couldn't write '3 3 3 3' to 'kernel/printk': Permission denied
Couldn't write '2' to 'net/core/bpf_jit_harden': Permission denied
I tried to improve security by hardening the internet settings as much as possible based on the kernel systctl section in this guide: Harden Fedora 44 for Desktop and Server: Complete Guide | ComputingForGeeks
and the CIS workstation L1 guide. I have very good reasons for wanting to do this. It worked for the earlier kernels so what do you suggest is the best way to resolve it?
Thank you
Cheers
John
