Drop setting vm.heap_stack_gap and net.ipv4 sysctl flags

[legoktm]

Status

Ready for review

Description of Changes

These are now set via the securedrop-grsec metapackage (see freedomofpress/kernel-builder#55).

Refs #7323.

Testing

How should the reviewer test this PR?

• visual review; compare that same flags are moved via Set net.ipv4 sysctl flags via server metapackage kernel-builder#55

Deployment

Any special considerations for deployment?

This can only be deployed after a kernel with freedomofpress/kernel-builder#55 is released stable. It's safe to merge ahead of time though once the kernel-builder one is approved.

Checklist

• Configuration tests pass

[zenmonkeykstop]

kernel-builder change looks good, but unless there's a compelling reason I'd keep the testinfra check.

[legoktm]

This should fail CI now because we haven't built new kernel packages yet, I will see about doing some today or tomorrow.

[legoktm]

The error is: sed -i '/^vm\\.heap_stack_gap/d' /etc/sysctld.conf", "sed: can't read /etc/sysctld.conf: No such file or directory

which I guess is an install order issue in that we're installing the new kernel before we try setting grsec kernel flags, so there's no sysctld.conf yet. Let me guard it with an if exists check in the metapackage.

[legoktm]

kernel-builder fix: freedomofpress/kernel-builder#57

[cfm]

I've merged freedomofpress/kernel-builder#57, @legoktm, and I'll be happy to re-review this once it passes with kernels rebuilt with it. (Let me know if you'd like me to build them tomorrow.)

Addressed in 37f1827.

[cfm]

Looks good after 37f1827 and freedomofpress/securedrop-apt-test#258. Thanks, @legoktm.