Kernel Hardening Capstone: Fix sysctl Parameters and Module Policy

A host's kernel runtime configuration is insecure and misconfigured in six independent ways — four sysctl parameters, one module that must be blacklisted, and one that must be configured to load at boot. Fix them under /etc/sysctl.d, /etc/modprobe.d, and /etc/modules-load.d. See /root/brief.txt for the exact module names. Grading reads the effective configured state — for sysctl, the last value set across /etc/sysctl.d/*.conf wins — and does not require the running kernel to change.

sysctl — four parameters are currently set to their insecure values. Decide the correct hardened value for each and set it:

1. This host is configured to forward IPv4 packets like a router, though it isn't one.

2. Reverse-path filtering is off, so spoofed source addresses aren't dropped — and the fix must cover every interface, not only the default.

3. The kernel ring buffer (dmesg) is readable by unprivileged users.

4. Setuid programs are permitted to write core dumps.

modules:

5. blacklist the offending module under /etc/modprobe.d/

6. configure the required module to load at boot under /etc/modules-load.d/