Hardening profile

Arkyn’s hardening is tuned for people who build software. Each setting has a reason, and some popular “hardening” switches are left off on purpose.

What is set

• AppArmor enforcing, with profiles that let Electron and Tauri apps (VSCodium, Proton Mail, Pass and Authenticator) keep their own sandboxes.
• Network: ICMP redirects ignored and never sent; source-routed packets refused; SYN cookies on.
• Kernel information: kernel pointers and the kernel log hidden from ordinary users (sudo dmesg still works).
• Debugging: a process may only trace its own children — gdb, strace and perf on your own programs still work.
• BPF: unprivileged BPF off.
• Core dumps: privileged (setuid) programs never dump core.
• IPv6 privacy addresses on every interface.

Deliberately not set

• User namespaces stay on. Browsers, Flatpak, rootless Podman and Electron apps use them to sandbox themselves; Ubuntu’s AppArmor rules still decide which apps may. Turning them off makes these programs less safe.
• Strict reverse-path filtering would break WireGuard VPNs and Docker networks.
• Hardened BPF JIT would slow every BPF program, including Proton VPN’s split tunnelling.
• kexec lockdown isn’t needed: Secure Boot already limits it to signed kernels.

Secure Boot and the kernel

Arkyn uses Canonical’s signed kernel, unmodified. Secure Boot works with no extra keys, and kernel security fixes arrive within days through automatic updates — a custom kernel would mean slower fixes.