colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/hardened: don't set kernel.unprivileged_bpf_disabled

Browse Source 
Upstreamed in anthraxx/linux-hardened@1a3e0c2830.
This commit is contained in:
Emily 2020-04-04 23:12:06 +01:00
parent 9da578a78f
commit 71bbd876b7
1 changed files with 0 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/profiles/hardened.nix
View File

@ -79,10 +79,6 @@ with lib;
# Hide kptrs even for processes with CAP_SYSLOG
boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
# Unprivileged access to bpf() has been used for privilege escalation in
# the past
boot.kernel.sysctl."kernel.unprivileged_bpf_disabled" = mkDefault true;
# Disable bpf() JIT (to eliminate spray attacks)
boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;