[rpms/systemd] rawhide: Adjust 99-kernel-hardening.conf

[rpms/systemd] rawhide: Adjust 99-kernel-hardening.conf

[@ 2026-07-17 10:23 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/systemd
            Branch : rawhide
            Commit : e48f1014bdcc667bef34fc3ea45521d42c4ed2f3
            Author : Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com>
            Date   : 2026-07-17T11:38:49+02:00
            Stats  : +9/-13 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/systemd/c/e48f1014bdcc667bef34fc3ea45521d42c4ed2f3?branch=rawhide

            Log:
            Adjust 99-kernel-hardening.conf

Adjust the wording for brevity and fix some typos.

[skip changelog]

---
diff --git a/99-kernel-hardening.conf b/99-kernel-hardening.conf
index 9d75be7..bf42b85 100644
--- a/99-kernel-hardening.conf
+++ b/99-kernel-hardening.conf
@@ -7,13 +7,14 @@
 # section 'Fedora-maintained self-updating kernel hardening'):
 #   https://docs.fedoraproject.org/en-US/security/topics/hardening
 #
-# If you want to enable the hardening, please create a symlink:
+# If you want to enable the hardening, create a symlink:
 #   sudo ln -s /usr/share/doc/systemd/99-kernel-hardening.conf /etc/sysctl.d/
 # -> do NOT copy or move or hardlink this file because
 # this would break the automatic updates!
 #
-# Enabling this file can cause issues to some software developers:
-# the need to use ptrace is restricted in the hardening
+#
+# Enabling this ptrace restriction can cause issues to some software
+# developers: the need to use ptrace is restricted in the hardening
 # because of the security issues it may cause in some
 # circumstances: to use applications like gdb or strace when the
 # hardening is enabled, users need to temporarily enable ptrace
@@ -28,10 +29,6 @@
 # For more information, read the Fedora hardening page
 # mentioned above.
 #
-# The parameter below are complemented by links to
-# their upstream and other useful documentation
-#
-#
 # Details: https://docs.kernel.org/admin-guide/sysctl/net.html
 # Details: https://wiki.archlinux.org/title/Security#BPF_hardening
 # Minor / partially-related side note: Fedora's kernel is compiled 
@@ -40,9 +37,9 @@ net.core.bpf_jit_harden = 2
 
 # Details: https://docs.kernel.org/admin-guide/LSM/Yama.html
 # Details: https://wiki.archlinux.org/title/Security#ptrace_scope
-# Minor / partially-related site note: 'setsebool -P deny_ptrace on'
-# can add a largely-overlapping security layer to achieve redundancy
-# in restricting ptrace: it is suggested to read the Fedora hardening
+# Side note: 'setsebool -P deny_ptrace on' can add a
+# largely-overlapping security layer to achieve redundancy in
+# restricting ptrace: it is suggested to read the Fedora hardening
 # page (link above) section 'Fedora-maintained (self-updating)
 # hardening for general and average use cases' and section
 # 'Fedora-maintained 'enable & forget' SELinux & firewalld hardening'
@@ -52,9 +49,8 @@ kernel.yama.ptrace_scope = 2
 # Details: https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict
 # Details: https://wiki.archlinux.org/title/Security#Restricting_access_to_kernel_pointers_in_the_proc_filesystem
 # This is formally not adding security because Fedora and its
-# downstream use pre-compiled kernels, but in vulnerable situations,
-# this can massively increase the required knowledge and necessary
-# understanding for hostile exploitation
+# downstream use pre-compiled kernels, but it increases
+# the knowledge required for successful exploitation.
 kernel.kptr_restrict = 2
 
 # This is unlikely to cause exploitable attack surface in average use