#Linux kernel resource locking mechanism full

Without proper measures, they might be able to start programs, or access data, they are not supposed to. This strategy is especially important for systems with local user accounts.

This may be an anonymous user visiting the website, or an authorized user which submits a print job. While not every system has users directly on the system, it often has indirect users. They are active entities, who want to use “objects”, like a file. Users and processes are often considered “subjects” on a system.

Since this strategy is useful for almost all systems, it is well invested time. While an initial set-up might take a while to analyze, configure and tune, it can be reapplied on other systems with similar functionality.

Configure logging for possible intrusion detection or forensics.

Limit ARP, DNS and routing to allowed paths only.

Disable interface not used or allowed (e.g.

Traffic you don’t want, should not be able to enter or leave the system. The strong area in this strategy is the focus on allowed paths, while (by default) blocking all others. This strategy is useful for most systems, especially those directly or indirectly being available via the internet. Both are possible with the kernel feature named Netfilter. For newer systems, this might be replaced with nftables. The most obvious measure is traffic filtering, which can be achieved with iptables tooling. Therefore this is another area which needs locking down.

Limit file descriptors, memory and other system resources which can be quickly exhaustedĪppArmor status on Ubuntu system Locking down networkingįor most information nowadays, it enters and leaves the system via the network.

Determine allowed directories/files, limit access as much as possible.

Determine an appropriate security framework like SELinux or AppArmor.

Check which users can start processes on the system, directly or indirectly.

To execute this strategy, follow at least the next steps: Another type of system which benefit is systems being part of a web cluster, or act as individual web servers. This strategy is in particular useful for systems which allow its user to start their own processes. From memory management, disk and file permissions, up to the resources. Processes can be locked down in different way. Another example might be a power saving utility, while the system is virtualized, and a better power management tool is used on the host system. It might be a NFS daemon which is simply not used. These last group of processes have a clear goal, but are not applicable for the machine. Not in the sense of numbers, but mainly the required processes including non-functional processes. It is common to see systems are running too much processes. After all, each system needs processes, to fulfill its roles. The first area to lock down are system processes. Time to review some of the strategies which can be applied when you want to secure your systems. This step-by-step locking down is a time consuming process.

#Linux kernel resource locking mechanism full

By locking down components on the system, the chance of a full compromise is lowered. Most of the security defenses on Linux, are based on the earlier performed hardening activities.