Adolfo Delorenzo
efc7f80b65
Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
21 lines
873 B
Bash
Executable File
21 lines
873 B
Bash
Executable File
#!/bin/sh
|
|
# 85-security-lockdown.sh — Lock down kernel after all modules loaded
|
|
|
|
# Allow disabling via boot parameter for debugging
|
|
if [ "$KUBESOLO_NOMODLOCK" = "1" ]; then
|
|
log_warn "Module lock DISABLED (kubesolo.nomodlock)"
|
|
else
|
|
# Permanently prevent new kernel module loading (irreversible until reboot)
|
|
# All required modules must already be loaded by stage 30
|
|
if [ -f /proc/sys/kernel/modules_disabled ]; then
|
|
echo 1 > /proc/sys/kernel/modules_disabled 2>/dev/null && \
|
|
log_ok "Kernel module loading locked" || \
|
|
log_warn "Failed to lock kernel module loading"
|
|
fi
|
|
fi
|
|
|
|
# Safety net: enforce kernel information protection
|
|
# (also set via sysctl.d but enforce here in case sysctl.d was bypassed)
|
|
echo 2 > /proc/sys/kernel/kptr_restrict 2>/dev/null || true
|
|
echo 1 > /proc/sys/kernel/dmesg_restrict 2>/dev/null || true
|