Which Linux Kernel sysctl Parameters and LSM Modules Provide Maximum Defense Against Privilege Escalation?

Maximum defense against Linux privilege escalation is achieved by configuring restrictive sysctl knobs that restrict kernel pointer disclosure (kptr_restrict=2), disable unprivileged eBPF (unprivileged_bpf_disabled=1), restrict ptrace debugging (yama.ptrace_scope=2), maximize ASLR entropy (mmap_rnd_bits=32), and enforcing Landlock unprivileged access sandboxing at the application layer.

Modern Linux server exploits rarely rely on simple brute-force password guessing. Instead, sophisticated adversaries compromise an unprivileged web application or containerized microservice, then leverage local kernel vulnerabilities (such as use-after-free flaws, race conditions, or unvalidated system calls) to elevate privileges to root.

Hardening the Linux kernel closes these vectors by eliminating informational leaks, enforcing strict memory isolation, and restricting dynamic kernel reconfiguration at runtime. We audited standard production kernels against hardened configurations, evaluating stability, memory allocation latency, and exploit resilience, cross-referenced with our guides to Docker and Proxmox container hardening and bare-metal firewall architectures.

Essential sysctl Hardening Configuration File

To implement an uncompromised defensive baseline on Ubuntu, Debian, or Rocky Linux servers, deploy the following configuration to /etc/sysctl.d/99-security-hardening.conf:

# Restrict kernel pointer disclosure to unprivileged users
kernel.kptr_restrict = 2

# Restrict dmesg kernel ring buffer access to CAP_SYSLOG
kernel.dmesg_restrict = 1

# Disable unprivileged eBPF execution permanently
kernel.unprivileged_bpf_disabled = 1
net.core.bpf_jit_harden = 2

# Restrict ptrace process inspection to root CAP_SYS_PTRACE
kernel.yama.ptrace_scope = 2

# Maximize Address Space Layout Randomization (ASLR) entropy
vm.mmap_rnd_bits = 32
vm.mmap_rnd_compat_bits = 16

# Prevent symlink and hardlink exploitation in world-writable dirs
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2

# Disable TCP SACK and timestamps to mitigate timing attacks
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_sack = 0

# Enable strict Reverse Path Filtering to stop IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

Execute sysctl -p /etc/sysctl.d/99-security-hardening.conf to immediately load these parameters into the active kernel without requiring a server reboot.

Landlock LSM: Unprivileged Application Sandboxing

While traditional Linux Security Modules (such as SELinux and AppArmor) require root privileges and complex policy compilation, Landlock LSM (merged in Linux 5.13+) empowers unprivileged user-space applications to build their own security boundaries:

• Filesystem Sandboxing: Using Landlock, a network daemon (e.g. NGINX or an API worker) can voluntarily drop access to the entire root filesystem at startup, allowing read-only access strictly to /var/www/ and read-write access to /tmp/, while completely blocking access to /etc/, /root/, and binary execution paths.
• TCP Port Restriction: Landlock can restrict a process to binding and connecting only to specific predefined TCP ports, preventing a compromised process from establishing outbound reverse shells to arbitrary command-and-control (C2) servers.

Hardened Memory Allocation with GrapheneOS hardened_malloc

Standard GNU C Library (glibc) memory allocators are optimized purely for single-threaded throughput, storing memory chunk metadata immediately adjacent to application buffers. This layout makes heap-based buffer overflows and use-after-free (UAF) bugs trivially exploitable.

By compiling and preloading GrapheneOS’s hardened_malloc via /etc/ld.so.preload for critical services, memory security is fundamentally transformed:

1. Metadata Segregation: All chunk metadata is stored in dedicated, write-protected memory pages physically isolated from user buffers, making metadata corruption attacks physically impossible.
2. Deterministic Zero-on-Free: Memory allocations are automatically zeroed out upon deallocation, instantly wiping cryptographic keys and preventing sensitive data re-use bugs.
3. Guard Pages: Randomly distributed non-accessible guard pages wrap allocations, causing memory overflow exploits to trigger instant segmentation faults rather than silent code execution.