kernel.unprivileged_userns_clone=0
kernel.kptr_restrict=2
kernel.dmesg_restrict=1
kernel.perf_event_paranoid=4
net.core.bpf_jit_harden=2
kernel.unprivileged_bpf_disabled=2

# Extended hardening
kernel.yama.ptrace_scope=2
kernel.core_pattern=|/bin/false
fs.suid_dumpable=0
kernel.sysrq=0
dev.tty.ldisc_autoload=0
kernel.perf_cpu_time_max_percent=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.all.accept_source_route=0