recipe_sysctl.ts

Recipes for kernel parameters a hardened host keeps set: a sysctl.d file that holds them across boots, and a script that puts them in force now.

• LINK_PROTECTION_SYSCTLS — the link and file protections the kernel applies in world-writable directories: a hard link to a file the linker doesn't own, a symlink followed out of a sticky directory, and a FIFO or regular file opened with O_CREAT in one, each refused. They close the class of attack in which one account plants a link or file at a path a more privileged process (root's apply, a service) then opens. systemd sets all four on Debian and Ubuntu; Alpine sets only the first two, so an Alpine host declares them.
• sysctl_conf — the sysctl.d file text for a set of parameters.
• sysctl_apply — the script that loads that file when a parameter's live value differs from it.

Distro-neutral: both families read /etc/sysctl.d/*.conf at boot (systemd's systemd-sysctl, OpenRC's sysctl service in the boot runlevel), and both sysctl commands (procps and BusyBox) load a file with -p.

Pure functions evaluated in zap's sandboxed config eval (fgro eval: no I/O, clock, or randomness); the output is deterministic.

The caller writes the file and orders the script after it, e.g. zap.file({id: 'sysctl-links', path: LINK_PROTECTION_SYSCTL_PATH, content: {type: 'inline', content: sysctl_conf(LINK_PROTECTION_SYSCTLS)}}) and zap.script({id: 'sysctl-links-applied', ...sysctl_apply(LINK_PROTECTION_SYSCTL_PATH, LINK_PROTECTION_SYSCTLS), depends_on: ['sysctl-links']}).