Lesson 4.42: Kernel settings that drift: sysctl precedence
Kernel hardening settings live in files under /etc/sysctl.d, applied in name order, so the last file to set a key wins. A 'temporary' debugging file named to sort late can quietly undo the whole baseline for years. In the lab Northwind's build server lets any process of a user read the memory of that user's other processes. You read the effective values, show what that means with strace against your own ssh-agent, find the file responsible, replace it with a baseline, apply it and confirm, and learn which switches can only be turned on until the next reboot.
18 min
You will learn to
- Read effective kernel settings with sysctl
- Explain Yama ptrace_scope and why it matters
- Find which sysctl.d file wins
- Apply a baseline with sysctl --system
- Know the one-way switches
Key terms
- sysctl
- Reads and sets kernel parameters under /proc/sys at runtime.
- /etc/sysctl.d
- Files applied at boot and by sysctl --system, in name order; the last value for a key wins.
- kernel.yama.ptrace_scope
- 0: any process may trace others of the same user; 1: only descendants; 2: admin only; 3: nobody.
- kernel.kptr_restrict
- Hides kernel addresses from unprivileged users (1) or everyone (2).
- perf_event_paranoid / unprivileged_bpf_disabled
- Limit unprivileged access to kernel profiling and to BPF programs.
- One-way switch
- A setting that can be turned on but not off until reboot.
← SSH certificates instead of authorized_keys · All lessons · The Docker socket and host mounts →