[rpms/systemd] rawhide: add 99-kernel-hardening.conf

[Christopher Klooz <py0xc3@posteo.net>]

A new commit has been pushed.

Repo   : rpms/systemd
Branch : rawhide
Commit : eaee67a709c7c5cd8fb8fcf3b84e987619abe500
Author : Christopher Klooz <py0xc3@posteo.net>
Date   : 2026-07-17T09:25:44+00:00
Stats  : +74/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/systemd/c/eaee67a709c7c5cd8fb8fcf3b84e987619abe500?branch=rawhide

Log:
add 99-kernel-hardening.conf

---
diff --git a/99-kernel-hardening.conf b/99-kernel-hardening.conf
new file mode 100644
index 0000000..9d75be7
--- /dev/null
+++ b/99-kernel-hardening.conf
@@ -0,0 +1,70 @@
+# This file is disabled by default. It provides a few kernel
+# hardening settings. This file is automatically updated.
+# 
+# Please read the Fedora hardening page for further information
+# about this file (section 'Fedora-maintained (self-updating)
+# hardening for general and average use cases' and
+# section 'Fedora-maintained self-updating kernel hardening'):
+#   https://docs.fedoraproject.org/en-US/security/topics/hardening
+#
+# If you want to enable the hardening, please create a symlink:
+#   sudo ln -s /usr/share/doc/systemd/99-kernel-hardening.conf /etc/sysctl.d/
+# -> do NOT copy or move or hardlink this file because
+# this would break the automatic updates!
+#
+# Enabling this file can cause issues to some software developers:
+# the need to use ptrace is restricted in the hardening
+# because of the security issues it may cause in some
+# circumstances: to use applications like gdb or strace when the
+# hardening is enabled, users need to temporarily enable ptrace
+# during the runtime of their ptrace-dependent application.
+# Enabling ptrace implies disabling yama.ptrace_scope (which is
+# the security measure enabled below).
+# You can enable temporarily ptrace with:
+#   sysctl kernel.yama.ptrace_scope=0
+# You can subsequently disable it again with:
+#   sysctl kernel.yama.ptrace_scope=2 
+# -> it will be reset automatically after reboot.
+# For more information, read the Fedora hardening page
+# mentioned above.
+#
+# The parameter below are complemented by links to
+# their upstream and other useful documentation
+#
+#
+# Details: https://docs.kernel.org/admin-guide/sysctl/net.html
+# Details: https://wiki.archlinux.org/title/Security#BPF_hardening
+# Minor / partially-related side note: Fedora's kernel is compiled 
+# with CONFIG_BPF_JIT_ALWAYS_ON=True
+net.core.bpf_jit_harden = 2
+
+# Details: https://docs.kernel.org/admin-guide/LSM/Yama.html
+# Details: https://wiki.archlinux.org/title/Security#ptrace_scope
+# Minor / partially-related site note: 'setsebool -P deny_ptrace on'
+# can add a largely-overlapping security layer to achieve redundancy
+# in restricting ptrace: it is suggested to read the Fedora hardening
+# page (link above) section 'Fedora-maintained (self-updating)
+# hardening for general and average use cases' and section
+# 'Fedora-maintained 'enable & forget' SELinux & firewalld hardening'
+# for further information about this.
+kernel.yama.ptrace_scope = 2
+
+# Details: https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict
+# Details: https://wiki.archlinux.org/title/Security#Restricting_access_to_kernel_pointers_in_the_proc_filesystem
+# This is formally not adding security because Fedora and its
+# downstream use pre-compiled kernels, but in vulnerable situations,
+# this can massively increase the required knowledge and necessary
+# understanding for hostile exploitation
+kernel.kptr_restrict = 2
+
+# This is unlikely to cause exploitable attack surface in average use
+# cases of OS that are appropriately pre-configured, but for the same
+# reason it is unlikely to cause issues to the users.
+# In case of a doubt, it mitigates some potential for attack surface,
+# including some attack surface the user might create themselves by
+# accident. Even if the latter applies, it is unlikely to cause an
+# impact except mitigate exploitation
+# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-fifos
+fs.protected_fifos = 2
+# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-regular
+fs.protected_regular = 2

diff --git a/systemd.spec b/systemd.spec
index c172dc5..f11b19d 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -129,7 +129,7 @@ Source15:       10-oomd-per-slice-defaults.conf
 Source16:       10-timeout-abort.conf
 Source17:       10-map-count.conf
 Source18:       60-block-scheduler.rules
-
+Source19:       99-kernel-hardening.conf
 Source20:       macros.sysusers.compat
 Source21:       macros.sysusers
 Source22:       sysusers.attr
@@ -1141,6 +1141,9 @@ install -Dm0644 -t %{buildroot}/usr/lib/firewalld/services/ %{SOURCE8} %{SOURCE9
 # https://bugzilla.redhat.com/show_bug.cgi?id=1234951
 install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE10}
 
+# Install kernel hardening file. Disabled by default.
+install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE19}
+
 # https://bugzilla.redhat.com/show_bug.cgi?id=1378974
 install -Dm0644 -t %{buildroot}%{system_unit_dir}/systemd-udev-trigger.service.d/ %{SOURCE11}