Restrict access to kernel symbol addresses

Description

The kernel.kptr_restrict sysctl parameter must be set to 1 or higher to restrict access to kernel symbol addresses via /proc/kallsyms and similar interfaces.

Rationale

Exposing kernel symbol addresses allows attackers to bypass kernel address space layout randomization (KASLR). Restricting access to kernel pointers prevents information disclosure that could aid exploitation of kernel vulnerabilities.

Framework references

Live verification