Файловый менеджер - Редактировать - /home/freeclou/app.optimyar.com/front-web/build/assets/columnDefs/sysctl.d.tar
Назад
10-default-yama-scope.conf 0000644 00000003422 15105476633 0011324 0 ustar 00 # When yama is enabled in the kernel it might be used to filter any user # space access which requires PTRACE_MODE_ATTACH like ptrace attach, access # to /proc/PID/{mem,personality,stack,syscall}, and the syscalls # process_vm_readv and process_vm_writev which are used for interprocess # services, communication and introspection (like synchronisation, signaling, # debugging, tracing and profiling) of processes. # # Usage of ptrace attach is restricted by normal user permissions. Normal # unprivileged processes cannot interact through ptrace with processes # that they cannot send signals to or processes that are running set-uid # or set-gid. # # yama ptrace scope can be used to reduce these permissions even more. # This should normally not be done because it will break various programs # relying on the default ptrace security restrictions. But can be used # if you don't have any other way to separate processes in their own # domains. A different way to restrict ptrace is to set the selinux # deny_ptrace boolean. Both mechanisms will break some programs relying # on the ptrace system call and might force users to elevate their # privileges to root to do their work. # # For more information see Documentation/security/Yama.txt in the kernel # sources. Which also describes the defaults when CONFIG_SECURITY_YAMA # is enabled in a kernel build (currently 1 for ptrace_scope). # # This runtime kernel parameter can be set to the following options: # (Note that setting this to anything except zero will break programs!) # # 0 - Default attach security permissions. # 1 - Restricted attach. Only child processes plus normal permissions. # 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE. # 3 - No attach. No process may call ptrace at all. Irrevocable. # kernel.yama.ptrace_scope = 0 50-libkcapi-optmem_max.conf 0000644 00000000366 15105476633 0011576 0 ustar 00 # See the 'README.redhat' file shipped in %doc # with the libkcapi package. # # See '/usr/lib/sysctl.d/50-default.conf', # if you need or want to override this preset. # Increase the ancillary buffer size per socket. net.core.optmem_max = 81920 50-coredump.conf 0000644 00000003433 15105476633 0007470 0 ustar 00 # This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. # See sysctl.d(5) for the description of the files in this directory. # Pipe the core file to systemd-coredump. The systemd-coredump process spawned # by the kernel will start a second copy of itself as the # systemd-coredump@.service, which will do the actual processing and storing of # the core dump. # # See systemd-coredump(8) and core(5). kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %d # Allow 16 coredumps to be dispatched in parallel by the kernel. # We collect metadata from /proc/%P/, and thus need to make sure the crashed # processes are not reaped until we have finished collecting what we need. The # kernel default for this sysctl is "0" which means the kernel doesn't wait for # userspace to finish processing before reaping the crashed processes. With a # higher setting the kernel will delay reaping until we are done, but only for # the specified number of crashes in parallel. The value of 16 is chosen to # match systemd-coredump.socket's MaxConnections= value. kernel.core_pipe_limit=16 # Also dump processes executing a set-user-ID/set-group-ID program that is # owned by a user/group other than the real user/group ID of the process, or # a program that has file capabilities. ("2" is called "suidsafe" in core(5)). # # systemd-coredump will store the core file owned by the effective uid and gid # of the running process (and not the filesystem-user-ID which the kernel uses # when saving a core dump). # # See proc(5), setuid(2), capabilities(7). fs.suid_dumpable=2 50-default.conf 0000644 00000003577 15105476633 0007307 0 ustar 00 # This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. # See sysctl.d(5) and core(5) for documentation. # To override settings in this file, create a local file in /etc # (e.g. /etc/sysctl.d/90-override.conf), and put any assignments # there. # System Request functionality of the kernel (SYNC) # # Use kernel.sysrq = 1 to allow all keys. # See https://docs.kernel.org/admin-guide/sysrq.html for a list # of values and keys. kernel.sysrq = 16 # Append the PID to the core filename kernel.core_uses_pid = 1 # Source route verification net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.*.rp_filter = 2 -net.ipv4.conf.all.rp_filter # Do not accept source routing net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.*.accept_source_route = 0 -net.ipv4.conf.all.accept_source_route # Promote secondary addresses when the primary address is removed net.ipv4.conf.default.promote_secondaries = 1 net.ipv4.conf.*.promote_secondaries = 1 -net.ipv4.conf.all.promote_secondaries # ping(8) without CAP_NET_ADMIN and CAP_NET_RAW # The upper limit is set to 2^31-1. Values greater than that get rejected by # the kernel because of this definition in linux/include/net/ping.h: # #define GID_T_MAX (((gid_t)~0U) >> 1) # That's not so bad because values between 2^31 and 2^32-1 are reserved on # systemd-based systems anyway: https://systemd.io/UIDS-GIDS#summary -net.ipv4.ping_group_range = 0 2147483647 # Fair Queue CoDel packet scheduler to fight bufferbloat -net.core.default_qdisc = fq_codel # Enable hard and soft link protection fs.protected_hardlinks = 1 fs.protected_symlinks = 1 # Enable regular file and FIFO protection fs.protected_regular = 1 fs.protected_fifos = 1 50-pid-max.conf 0000644 00000001173 15105476633 0007210 0 ustar 00 # This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. # See sysctl.d(5) and core(5) for documentation. # To override settings in this file, create a local file in /etc # (e.g. /etc/sysctl.d/90-override.conf), and put any assignments # there. # Bump the numeric PID range to its maximum of 2^22 (from the in-kernel default # of 2^16), to make PID collisions less likely. kernel.pid_max = 4194304 README 0000644 00000000603 15105476633 0005435 0 ustar 00 Files in this directory contain configuration for systemd-sysctl.service, a service to configure sysctl kernel parameters. See man:sysctl.d(5) for explanation of the configuration file format, and man:sysctl(8) and man:systemd-sysctl.service(8) for a description of when and how this configuration is applied. Use 'systemd-analyze cat-config sysctl.d' to display the effective config. 50-redhat.conf 0000644 00000000313 15105476633 0007113 0 ustar 00 # https://bugzilla.redhat.com/show_bug.cgi?id=1689346 kernel.kptr_restrict = 1 # Source route verification net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.*.rp_filter = 1 -net.ipv4.conf.all.rp_filter
| ver. 1.4 |
Github
|
.
| PHP 8.1.33 | Генерация страницы: 0 |
proxy
|
phpinfo
|
Настройка