[teddyh]

Some of the descriptions of sysctl parameters are mixed up and wrong:

  kernel.core_uses_pid  Block USB devices
  kernel.ctrl-alt-del   Disable access to dmesg for unprivileged users
  kernel.dmesg_restrict Disable kexec to prevent kernel livepatching
  kernel.kptr_restrict  Restrict access to kernel logs

The official documentation for /proc/sys and sysctl settings is here: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/in...

The article seems to mostly exist to be a showcase for Falco, which apparently is some sort of file change security monitor.

[nerdponx]

The official docs are surprisingly friendly and helpful! This is a great demonstration of the value of reference docs beyond whatever is in the source code.