Kernel, Filesystem and Boot Hardening

Kernel Parameters Beyond the Basics

Every value under /proc/sys is a switch in the running kernel, and OpenVAPT reads those files directly instead of running sysctl. Module P1 covered address space layout randomisation, hidden kernel pointers and the common network settings. The depth checks add the rest of the set the Kernel Self Protection Project recommends for servers. Protected FIFOs and regular files in shared directories (fs.protected_fifos and fs.protected_regular) close the last of the classic /tmp tricks. User namespaces, userfaultfd, TTY line discipline autoload and io_uring are features normal users rarely need. Each has been the first step of real local privilege escalations. kexec lets root swap the running kernel and so bypass Secure Boot. BPF just-in-time hardening stops attacker-chosen constants landing in executable kernel memory.

On the network side, the depth checks close the IPv6 copies of the IPv4 rules (source routing, router advertisements). They also cover the secure_redirects setting, often forgotten when accept_redirects is turned off. The magic SysRq key is disabled because anyone at a console can otherwise reboot or dump memory without a password. A permanent setting goes in a file under /etc/sysctl.d, which is applied at every boot by sysctl --system.

Mounts and Mount Options

A filesystem that is a separate mount can carry options that the root filesystem cannot. nodev stops device files being created where users can write, nosuid stops a planted setuid program gaining privilege, and noexec stops downloaded tools running at all. Temporary directories, user homes and the log tree are where untrusted users or runaway processes write. Putting each on its own mount also stops a full disk in one place from stopping the whole server. OpenVAPT reads the mount table from /proc/mounts, so what it reports is what the kernel is enforcing now, not what /etc/fstab promises after the next reboot.

Ownership, SUID Inventory and Shared Directories

A file whose owner id no longer exists in /etc/passwd will belong to the next account created with that id. That is how a new intern inherits an old administrator's scripts. Set-user-ID programs run with their owner's rights, so each one is a potential door to root. The inventory check compares every SUID program in the system directories with a documented baseline of what distributions ship. It lists the rest for a human decision. A shared writable directory needs the sticky bit so one user cannot delete or replace another user's files, and a service's upload folder is the same problem as /tmp.

The default umask decides what new files everyone else can read. /etc/login.defs sets it for logins, but a umask line in /etc/profile or /etc/bash.bashrc overrides it for every interactive shell, which is why both are checked. Cron and at should use allow lists rather than deny lists, and the cron configuration should be unreadable to normal users so they cannot learn which root scripts run when. Backup copies of the account database (passwd-, shadow-) carry the same secrets as the live files and need the same ownership and modes.

Boot Loader, Secure Boot and Kernel Modules

Everything above assumes the kernel that is running is the one you installed. A boot loader without a password lets anyone at the console add init=/bin/bash to the kernel command line and get root. GRUB fixes that with a superuser and a PBKDF2 password hash. Secure Boot makes the firmware refuse unsigned boot loaders and kernels, and OpenVAPT reads its state from the EFI variable rather than running a command. Once booted, kernel module signing (module.sig_enforce), lockdown mode or kernel.modules_disabled stop a root-level attacker loading a rootkit module. modprobe.d install lines disable drivers nobody needs, such as rarely used filesystems and USB storage.

Integrity Monitoring, Prelink and Core Dumps

After a compromise the question is which files changed. A file integrity tool such as AIDE records a baseline of hashes and permissions and compares against it on a schedule. A tool that is installed but never scheduled protects nothing, so the check wants both. Prelink rewrites binaries in place, which breaks those hashes and package verification, so it should be absent. Core dumps are copies of a crashed program's memory, including any passwords or keys it held. A hard core 0 limit in PAM, and Storage=none where systemd-coredump collects dumps, keep them from being written at all.

In Summary

The kernel, the mounts and the boot chain decide what a process may do before any application code runs. Read sysctl values from /proc/sys and give temporary and shared directories noexec, nosuid and nodev. Keep the SUID list short and known, and protect the boot loader and the module list. Let an integrity tool and a core dump policy show when something changed.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST-KRN- --out p15 and read the evidence line of each failed kernel parameter; find its hardened value in internal/lab/fixtures_kernel_fs_boot.go.
2. Run: openvapt explain HOST-FS-016 and compare the baseline list in the source with the SUID programs on a test machine you own: find /usr/bin /usr/sbin -perm /6000 -type f
3. Run: openvapt demo --only HOST-BOOT- and explain, for each finding, what an attacker with console access could do before the fix.
4. On a test machine you own: findmnt -no TARGET,OPTIONS /tmp /var/tmp /dev/shm /home and decide which options are missing.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• Linux kernel documentation, /proc/sys/kernel
• Kernel Self Protection Project, Recommended Settings
• NIST SP 800-123, Guide to General Server Security
• GNU GRUB Manual, Security
• AIDE, Advanced Intrusion Detection Environment

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P17: Kernel, Filesystem and Boot Hardening (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p17.html

@misc{openvapt_p17,
  author       = {{OpenVAPT}},
  title        = {{P17: Kernel, Filesystem and Boot Hardening}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p17.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}