Version: 2

In the /usr/lib/sysctl.d/10-hardening.conf file provided by the
package hardening-runtime, the last line provides an optional option
to be enabled. It is misspelled
It is not kernel.modules_disable but kernel.modules_disabled (with a
'd' at the end)

Also is it best to use space around systctl option in a config file,
so the line better be
#kernel_modules_disabled = 1

Just above the vm.mmap_rnd_bits option also lacks spaces around the
equal sign (=)

oops I made a typo, I meant

kernel.modules_disabled = 1

Also in that same file, I can see:
# On Debian kernel.unprivileged_userns_clone is set to 0 by default as well

but it seems to me that the value, at least here is:
kernel.unprivileged_userns_clone = 1

Le jeu. 20 août 2026 à 11:04, Debian Bug Tracking System
<owner@bugs.debian.org> a écrit :