Fix sysctl handling for noble/Linux 6.6

[legoktm]

Description

With noble/Linux 6.6, the grsec_lock flag now strictly enforces that it cannot be set again, even if the value is the same as the current. This means running sysctl -p /etc/sysctl.conf after it is set will error out.

We also set each sysctl flag twice, once for each one explicitly, and then again with sysctl -p /etc/sysctl.conf. I think we should switch to just doing sysctl -p once, globally.

• grsec_sysctl_flags:
  • kernel.grsecurity.rwxmap_logging
  • kernel.grsecurity.grsec_lock
  • vm.heap_stack_gap <-- now fails because it's after grsec_lock; note that this is already set via the securedrop-grsec package
• sysctl_flags, which is all net.ipv4.* stuff. setting these also fail because it's after the grsec_lock. I think we can just move them all to the kernel metapackage, and ensure it gets released before the next SD server release.

So proposed work plan:

1. Move net.ipv4 flags to securedrop-grsec metapackage; postinst will remove vm.heap_stack_gap and net.ipv4 flags from sysctl.conf: Set net.ipv4 sysctl flags via server metapackage kernel-builder#55
2. ansible change to stop setting vm.heap_stack_gap and net.ipv4 flags for new installs: Drop setting vm.heap_stack_gap and net.ipv4 sysctl flags #7324
3. Switch to sysctl -p once, globally (in ansible provisioning)
4. Ship kernel upgrade for step 1
5. Release SD server with step 2