Hide kernel addresses from users

Description

The kernel.kptr_restrict sysctl controls whether kernel pointers printed through %pK (for example in /proc/kallsyms and /proc/modules) are shown. With 1, they are hidden from users without the CAP_SYSLOG capability. With 2, they are hidden from everyone, including root.

Ubuntu ships 1 (/etc/sysctl.d/10-kernel-hardening.conf, /usr/lib/sysctl.d/55-kernel-hardening.conf on 26.04), which hides pointers from unprivileged users only, so the check fails with the default parameter. The value can be raised at runtime; lowering it needs no reboot either.

Rationale

Kernel exploits need the address of kernel structures and functions. The kernel randomizes its own layout at boot, but a single leaked pointer is enough to undo that randomization. Hiding pointers removes an easy source of leaks for a local attacker.

Impact

With 2, profiling and tracing tools run as root (perf, some eBPF tools) see zeroed kernel addresses and cannot resolve kernel symbols. Use 1 on hosts where administrators need them.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run sysctl kernel.kptr_restrict. The value must be at least {{ kptr_restrict }}. Then check that no sysctl configuration file sets a lower value.

Automated: every check must pass. Scanners report each check by its id.

running

Running value of kernel.kptr_restrict.

key: kernel.kptr_restrict
operator: '>='
value: '{{ kptr_restrict }}'

Remediation

Create /etc/sysctl.d/60-cirsec.conf containing kernel.kptr_restrict = {{ kptr_restrict }}, remove any other assignment of this key, then run sysctl --system.

Rollback

Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl -w kernel.kptr_restrict=1.

set

Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Ubuntu Security documentation - Kernel protections Canonical, vendor-doc, accessed 2026-10-19
• Linux kernel documentation - Documentation for /proc/sys/kernel/ (kptr_restrict) The Linux Kernel Organization, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R9) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle