--- title: "P17: Kernel, Filesystem and Boot Hardening" canonical: https://openvapt.com/academy/p17.html html: https://openvapt.com/academy/p17.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P17: Kernel, Filesystem and Boot Hardening Why the kernel's own switches, the layout and permissions of the filesystem, and what happens before login decide how far an attacker with a foothold can get. - Level: Practitioner - Time: about 35 minutes - Read first: P1 ## You Will Be Able To - Explain what the main kernel hardening parameters protect against and where their values live. - Explain why temporary, home and log directories are mounted separately with nodev, nosuid and noexec. - Audit SUID programs, unowned files, sticky bits, cron access lists and the default umask. - Explain how a boot loader password, Secure Boot, module restrictions and file integrity monitoring work together. ## Kernel Parameters Beyond the Basics Every value under /proc/sys is a switch in the running kernel, and OpenVAPT reads those files directly instead of running sysctl. Module P1 covered address space layout randomisation, hidden kernel pointers and the common network settings. The depth checks add the rest of the set the Kernel Self Protection Project recommends for servers. Protected FIFOs and regular files in shared directories (fs.protected_fifos and fs.protected_regular) close the last of the classic /tmp tricks. User namespaces, userfaultfd, TTY line discipline autoload and io_uring are features normal users rarely need. Each has been the first step of real local privilege escalations. kexec lets root swap the running kernel and so bypass Secure Boot. BPF just-in-time hardening stops attacker-chosen constants landing in executable kernel memory. On the network side, the depth checks close the IPv6 copies of the IPv4 rules (source routing, router advertisements). They also cover the secure_redirects setting, often forgotten when accept_redirects is turned off. The magic SysRq key is disabled because anyone at a console can otherwise reboot or dump memory without a password. A permanent setting goes in a file under /etc/sysctl.d, which is applied at every boot by sysctl --system. ## Mounts and Mount Options A filesystem that is a separate mount can carry options that the root filesystem cannot. nodev stops device files being created where users can write, nosuid stops a planted setuid program gaining privilege, and noexec stops downloaded tools running at all. Temporary directories, user homes and the log tree are where untrusted users or runaway processes write. Putting each on its own mount also stops a full disk in one place from stopping the whole server. OpenVAPT reads the mount table from /proc/mounts, so what it reports is what the kernel is enforcing now, not what /etc/fstab promises after the next reboot. ## Ownership, SUID Inventory and Shared Directories A file whose owner id no longer exists in /etc/passwd will belong to the next account created with that id. That is how a new intern inherits an old administrator's scripts. Set-user-ID programs run with their owner's rights, so each one is a potential door to root. The inventory check compares every SUID program in the system directories with a documented baseline of what distributions ship. It lists the rest for a human decision. A shared writable directory needs the sticky bit so one user cannot delete or replace another user's files, and a service's upload folder is the same problem as /tmp. The default umask decides what new files everyone else can read. /etc/login.defs sets it for logins, but a umask line in /etc/profile or /etc/bash.bashrc overrides it for every interactive shell, which is why both are checked. Cron and at should use allow lists rather than deny lists, and the cron configuration should be unreadable to normal users so they cannot learn which root scripts run when. Backup copies of the account database (passwd-, shadow-) carry the same secrets as the live files and need the same ownership and modes. ## Boot Loader, Secure Boot and Kernel Modules Everything above assumes the kernel that is running is the one you installed. A boot loader without a password lets anyone at the console add init=/bin/bash to the kernel command line and get root. GRUB fixes that with a superuser and a PBKDF2 password hash. Secure Boot makes the firmware refuse unsigned boot loaders and kernels, and OpenVAPT reads its state from the EFI variable rather than running a command. Once booted, kernel module signing (module.sig_enforce), lockdown mode or kernel.modules_disabled stop a root-level attacker loading a rootkit module. modprobe.d install lines disable drivers nobody needs, such as rarely used filesystems and USB storage. ## Integrity Monitoring, Prelink and Core Dumps After a compromise the question is which files changed. A file integrity tool such as AIDE records a baseline of hashes and permissions and compares against it on a schedule. A tool that is installed but never scheduled protects nothing, so the check wants both. Prelink rewrites binaries in place, which breaks those hashes and package verification, so it should be absent. Core dumps are copies of a crashed program's memory, including any passwords or keys it held. A hard core 0 limit in PAM, and Storage=none where systemd-coredump collects dumps, keep them from being written at all. ## In Summary The kernel, the mounts and the boot chain decide what a process may do before any application code runs. Read sysctl values from /proc/sys and give temporary and shared directories noexec, nosuid and nodev. Keep the SUID list short and known, and protect the boot loader and the module list. Let an integrity tool and a core dump policy show when something changed. ## Apply It - [HOST-BOOT-001 Boot Loader Has No Password](https://openvapt.com/checks/HOST-BOOT-001.md) (medium) - [HOST-BOOT-002 UEFI Secure Boot Disabled](https://openvapt.com/checks/HOST-BOOT-002.md) (medium) - [HOST-BOOT-003 Uncommon Filesystem Modules Not Disabled](https://openvapt.com/checks/HOST-BOOT-003.md) (medium) - [HOST-BOOT-004 USB Storage Driver Not Disabled](https://openvapt.com/checks/HOST-BOOT-004.md) (medium) - [HOST-BOOT-005 Kernel Module Loading Unrestricted](https://openvapt.com/checks/HOST-BOOT-005.md) (low) - [HOST-BOOT-006 No File Integrity Monitoring](https://openvapt.com/checks/HOST-BOOT-006.md) (medium) - [HOST-BOOT-007 Prelink Installed](https://openvapt.com/checks/HOST-BOOT-007.md) (low) - [HOST-BOOT-008 Core Dumps Not Restricted](https://openvapt.com/checks/HOST-BOOT-008.md) (low) - [HOST-FS-010 /var/tmp Not a Separate Filesystem](https://openvapt.com/checks/HOST-FS-010.md) (low) - [HOST-FS-011 /home Not a Separate Filesystem With nodev](https://openvapt.com/checks/HOST-FS-011.md) (low) - [HOST-FS-012 Log Directories on the Root Filesystem](https://openvapt.com/checks/HOST-FS-012.md) (low) - [HOST-FS-013 Temporary Filesystems Allow Executables](https://openvapt.com/checks/HOST-FS-013.md) (low) - [HOST-FS-014 World-Writable Files Outside Temporary Directories](https://openvapt.com/checks/HOST-FS-014.md) (medium) - [HOST-FS-015 Files With No Known Owner or Group](https://openvapt.com/checks/HOST-FS-015.md) (low) - [HOST-FS-016 SUID or SGID Programs Outside the Known Baseline](https://openvapt.com/checks/HOST-FS-016.md) (medium) - [HOST-FS-017 World-Writable Directories Without the Sticky Bit](https://openvapt.com/checks/HOST-FS-017.md) (medium) - [HOST-FS-018 Kernel Symbol Map or Initial RAM Disk Readable by Others](https://openvapt.com/checks/HOST-FS-018.md) (low) - [HOST-FS-019 Cron and At Not Restricted to Allowed Users](https://openvapt.com/checks/HOST-FS-019.md) (low) - [HOST-FS-020 Cron Configuration Readable by Other Users](https://openvapt.com/checks/HOST-FS-020.md) (low) - [HOST-FS-021 Shell Profile Sets a Permissive File Creation Mask](https://openvapt.com/checks/HOST-FS-021.md) (low) - [HOST-FS-022 Account Database Files or Their Backups Not Owned and Locked by Root](https://openvapt.com/checks/HOST-FS-022.md) (high) - [HOST-KRN-019 Magic SysRq Key Enabled](https://openvapt.com/checks/HOST-KRN-019.md) (low) - [HOST-KRN-020 FIFO Protection in Shared Directories Disabled](https://openvapt.com/checks/HOST-KRN-020.md) (low) - [HOST-KRN-021 Regular File Protection in Shared Directories Disabled](https://openvapt.com/checks/HOST-KRN-021.md) (low) - [HOST-KRN-022 Unprivileged User Namespaces Allowed](https://openvapt.com/checks/HOST-KRN-022.md) (low) - [HOST-KRN-023 IPv6 Source-Routed Packets Accepted](https://openvapt.com/checks/HOST-KRN-023.md) (low) - [HOST-KRN-024 Secure ICMP Redirects Accepted](https://openvapt.com/checks/HOST-KRN-024.md) (low) - [HOST-KRN-025 IPv6 Router Advertisements Accepted](https://openvapt.com/checks/HOST-KRN-025.md) (low) - [HOST-KRN-026 Bogus ICMP Error Responses Logged](https://openvapt.com/checks/HOST-KRN-026.md) (low) - [HOST-KRN-027 Kexec Kernel Replacement Allowed](https://openvapt.com/checks/HOST-KRN-027.md) (low) - [HOST-KRN-028 Unprivileged userfaultfd Allowed](https://openvapt.com/checks/HOST-KRN-028.md) (low) - [HOST-KRN-029 TTY Line Discipline Autoloading Enabled](https://openvapt.com/checks/HOST-KRN-029.md) (low) - [HOST-KRN-030 BPF JIT Hardening Off](https://openvapt.com/checks/HOST-KRN-030.md) (low) - [HOST-KRN-031 io_uring Open to Unprivileged Users](https://openvapt.com/checks/HOST-KRN-031.md) (low) ## Lab 1. `Run: openvapt demo --only HOST-KRN- --out p15 and read the evidence line of each failed kernel parameter; find its hardened value in internal/lab/fixtures_kernel_fs_boot.go.` 2. `Run: openvapt explain HOST-FS-016 and compare the baseline list in the source with the SUID programs on a test machine you own: find /usr/bin /usr/sbin -perm /6000 -type f` 3. `Run: openvapt demo --only HOST-BOOT- and explain, for each finding, what an attacker with console access could do before the fix.` 4. `On a test machine you own: findmnt -no TARGET,OPTIONS /tmp /var/tmp /dev/shm /home and decide which options are missing.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Where does OpenVAPT read kernel parameter values from? - A. The output of the sysctl command - B. Files under /proc/sys - C. /etc/sysctl.conf - D. The kernel boot log from dmesg - Answer: B. Reading /proc/sys shows the value the kernel enforces now, without running a command. 2. What does the noexec mount option on /tmp prevent? - A. Creating files in /tmp - B. Running programs stored in /tmp - C. Reading other users' files in /tmp - D. Deleting other users' files in /tmp - Answer: B. Downloaded tools cannot be executed from a noexec filesystem. 3. A file is owned by uid 1003, which is not in /etc/passwd. What is the risk? - A. The file cannot be opened by anyone - B. The next account created with uid 1003 inherits it - C. The kernel deletes it at reboot - D. Root automatically takes ownership of it - Answer: B. Ownership is numeric; a new account with that id silently owns old files. 4. Why does a GRUB password matter on a server in a locked room? - A. It encrypts the disk - B. Console and virtual console access still allows editing the boot command line - C. It is required by Secure Boot - D. It makes the server boot faster - Answer: B. Anyone with console or out-of-band management access can otherwise boot to a root shell. 5. AIDE is installed but no timer or cron job runs it. Does the integrity check pass? - A. Yes, the tool is present - B. No, a baseline that is never compared protects nothing - C. Only if prelink is absent - D. Yes, if it came from a signed package - Answer: B. The check wants the tool and a scheduled comparison. ## Key Terms - Sysctl: The kernel's run-time settings, each one a file under /proc/sys; the sysctl command reads and writes them and /etc/sysctl.d makes a value permanent. - Mount Option: A flag applied when a filesystem is mounted, such as nodev, nosuid or noexec, that limits what files on it may do. - Sticky Bit: A permission on shared directories such as /tmp that stops users deleting each other's files. - SUID: Set-user-ID: a file permission that makes a program run with its owner's privileges, often root. - Umask: The permission bits removed from every new file a process creates; 027 keeps new files unreadable to other users, 022 does not. - Secure Boot: A UEFI firmware feature that refuses to run boot loaders and kernels that are not signed by a trusted key. - Kernel Module: A piece of kernel code loaded at run time, such as a driver or filesystem; loading one gives full control of the kernel, so loading is restricted on hardened systems. - File Integrity Monitoring: Recording hashes, permissions and owners of important files as a baseline and comparing against it on a schedule to detect unexpected changes. - Core Dump: A file holding a crashed program's memory, written for debugging; it can contain passwords and keys the program held. - Hardening: Reducing a system's attack surface and weaknesses through configuration. ## References - [Linux kernel documentation, /proc/sys/kernel](https://docs.kernel.org/admin-guide/sysctl/kernel.html) - [Kernel Self Protection Project, Recommended Settings](https://kspp.github.io/Recommended_Settings) - [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final) - [GNU GRUB Manual, Security](https://www.gnu.org/software/grub/manual/grub/html_node/Security.html) - [AIDE, Advanced Intrusion Detection Environment](https://aide.github.io/) Offline: `openvapt learn P17`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p17.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.