Lesson 5.4: Kernel and AppArmor hardening
Some protections don't fix a specific bug; they make whole families of exploits harder. Kernel settings (sysctl) such as address space randomisation, protected links and ignoring ICMP redirects, and mandatory access control with AppArmor, which limits what a program may do even if it's taken over. In the lab you find a server where someone switched these protections off while debugging, restore them persistently in /etc/sysctl.d, verify, and move the web server's AppArmor profile from complain to enforce mode.
17 min
You will learn to
- Explain exploit mitigations such as ASLR
- Read and set kernel parameters with sysctl
- Make sysctl settings persistent
- Explain mandatory access control and AppArmor modes
- Enforce an AppArmor profile
Key terms
- sysctl
- The interface for reading and changing kernel parameters at runtime; persistent settings live in /etc/sysctl.conf and /etc/sysctl.d/.
- ASLR
- Address Space Layout Randomization: loads code and data at random addresses so exploits can't rely on fixed locations.
- Mandatory access control (MAC)
- Rules set by the administrator that limit what a program may do, which even root-run programs can't change.
- Enforce and complain modes
- AppArmor profile modes: enforce blocks and logs violations, complain only logs them.
- ICMP redirect
- A message telling a host to use another router; accepting them lets someone on the network reroute traffic.
← DHCP: how devices get their network settings · All lessons · Cross-site request forgery (CSRF) →