Grsecurity/Appendix/Sysctl Options

Below is a table of every available option in grsecurity that can be changed at runtime. The options can be changed using the sysctl interface, or by echoing values to files in /proc/sys/kernel/grsecurity/. Available options vary depending on how grsecurity was configured. See Configuring and Installing grsecurity and Runtime configuration for more information.

To find out what options are available in your system, list the contents of /proc/sys/kernel/grsecurity. If you use the sysctl interface, all of grsecurity's option are prefixed with kernel.grsecurity (e.g. kernel.grsecurity.audit_chdir).

Clicking an option will take you to or at least close to its description in another appendix page.

All sysctl variables

Auditing	Chroot restrictions	Network-based features	Misc. options
audit_chdir audit_gid audit_group audit_mount audit_ptrace chroot_execlog exec_logging forkfail_logging resource_logging rwxmap_logging signal_logging timechange_logging	chroot_caps chroot_deny_chmod chroot_deny_chroot chroot_deny_fchdir chroot_deny_mknod chroot_deny_mount chroot_deny_pivot chroot_deny_shmat chroot_deny_sysctl chroot_deny_unix chroot_enforce_chdir chroot_findtask chroot_restrict_nice	harden_ipc ip_blackhole socket_all socket_all_gid socket_client socket_all_gid socket_client socket_client_gid socket_server socket_server_gid	consistent_setxid deny_new_usb deter_bruteforce disable_priv_io dmesg enforce_symlinksifowner fifo_restrictions harden_ptrace lastack_retries linking_restrictions ptrace_readexec romount_protect symlinkown_gid tpe tpe_gid tpe_invert tpe_restrict_all