| Message ID | e64adbb7-eeaa-db72-e421-da6a20fe5705@ipfire.org |
|---|---|
| State | Accepted |
| Commit | 45022af1b80270039d649cde6071fe30344ae443 |
| Headers |
Return-Path: <development-bounces@lists.ipfire.org> Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4FH78m5JdYz3yBV for <patchwork@web04.haj.ipfire.org>; Fri, 9 Apr 2021 19:14:00 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4FH78l5lnDz1QD; Fri, 9 Apr 2021 19:13:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4FH78l4V0Xz2yTP; Fri, 9 Apr 2021 19:13:59 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4FH78k5s3Pz2xS8 for <development@lists.ipfire.org>; Fri, 9 Apr 2021 19:13:58 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4FH78j6QcJztW for <development@lists.ipfire.org>; Fri, 9 Apr 2021 19:13:57 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1617995638; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tTVQIcjtOLZdu4dNezW/KMsK01UVFjL5PXnmGk6bLm4=; b=2ie+hcbM153Hz1G/Rxl+jF62W2N6B/qI/drybVpLx2Zxj8emK0Buyq6L5i8VgZXPFMLysz kyCEtIsFpM56Q5Dg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1617995638; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tTVQIcjtOLZdu4dNezW/KMsK01UVFjL5PXnmGk6bLm4=; b=LknRg4wpFV8ovs9eK39Oyk2DbZQrFWE2g/U0Vu1RkApcPYQkSYVS46xoWxVPiZdOwGHqls hauEDZTD10jC5J6bViusBNSk83k1AiGVqtd8ijKppiJLTmeZPCax/93n9SzNLdg9nl7xGV TIEZBIKWldKibGBYEFxWSOQ6Edj7TG+lAbfvSXmzTHDumJFUWBaDy7SXu7z9bSPjaEPskJ tT6OhC12hsBtXZJ72ZEi25UhxZTFLLxnR568uMfxSiHxY8r7GfSfVzVhCq145g1XnPJX1O FS7gkn2M6xd308FacIxmpRCd0aJqPE9gnond15AZsPfweWVwQr1f4+5Pc59UMQ== To: "IPFire: Development" <development@lists.ipfire.org> From: =?utf-8?q?Peter_M=C3=BCller?= <peter.mueller@ipfire.org> Subject: [PATCH v2] sysctl.conf: Turn on BPF JIT hardening, if the JIT is enabled Message-ID: <e64adbb7-eeaa-db72-e421-da6a20fe5705@ipfire.org> Date: Fri, 9 Apr 2021 21:13:52 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk <development.lists.ipfire.org> List-Unsubscribe: <https://lists.ipfire.org/mailman/options/development>, <mailto:development-request@lists.ipfire.org?subject=unsubscribe> List-Archive: <http://lists.ipfire.org/pipermail/development/> List-Post: <mailto:development@lists.ipfire.org> List-Help: <mailto:development-request@lists.ipfire.org?subject=help> List-Subscribe: <https://lists.ipfire.org/mailman/listinfo/development>, <mailto:development-request@lists.ipfire.org?subject=subscribe> Errors-To: development-bounces@lists.ipfire.org Sender: "Development" <development-bounces@lists.ipfire.org> |
| Series |
[v2] sysctl.conf: Turn on BPF JIT hardening, if the JIT is enabled
|
|
Commit Message
Peter Müller
April 9, 2021, 7:13 p.m. UTC
The second version of this patch splits this up into different
architecture-specific sysctl config files, as i586 does not support BPF
JIT, hence the net.core.bpf_jit_harden does not exist on that
architecture.
Fixes: #12384
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
config/etc/sysctl-aarch64.conf | 2 ++
config/etc/sysctl-armv5tel.conf | 2 ++
config/etc/sysctl-x86_64.conf | 3 +++
3 files changed, 7 insertions(+)
create mode 100644 config/etc/sysctl-aarch64.conf
create mode 100644 config/etc/sysctl-armv5tel.conf
Comments
Hello, Thanks for the patch, but this broken shipping the files which I hopefully fixed properly here: https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=7ae1dcb33e27d2ea354acd6e7093741781e4092d Best, -Michael > On 9 Apr 2021, at 20:13, Peter Müller <peter.mueller@ipfire.org> wrote: > > The second version of this patch splits this up into different > architecture-specific sysctl config files, as i586 does not support BPF > JIT, hence the net.core.bpf_jit_harden does not exist on that > architecture. > > Fixes: #12384 > > Signed-off-by: Peter Müller <peter.mueller@ipfire.org> > --- > config/etc/sysctl-aarch64.conf | 2 ++ > config/etc/sysctl-armv5tel.conf | 2 ++ > config/etc/sysctl-x86_64.conf | 3 +++ > 3 files changed, 7 insertions(+) > create mode 100644 config/etc/sysctl-aarch64.conf > create mode 100644 config/etc/sysctl-armv5tel.conf > > diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf > new file mode 100644 > index 000000000..9f840806d > --- /dev/null > +++ b/config/etc/sysctl-aarch64.conf > @@ -0,0 +1,2 @@ > +# Turn on BPF JIT hardening, if the JIT is enabled. > +net.core.bpf_jit_harden = 2 > diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf > new file mode 100644 > index 000000000..9f840806d > --- /dev/null > +++ b/config/etc/sysctl-armv5tel.conf > @@ -0,0 +1,2 @@ > +# Turn on BPF JIT hardening, if the JIT is enabled. > +net.core.bpf_jit_harden = 2 > diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf > index 7384bed51..c7abecc5d 100644 > --- a/config/etc/sysctl-x86_64.conf > +++ b/config/etc/sysctl-x86_64.conf > @@ -1,3 +1,6 @@ > # Improve KASLR effectiveness for mmap > vm.mmap_rnd_bits = 32 > vm.mmap_rnd_compat_bits = 16 > + > +# Turn on BPF JIT hardening, if the JIT is enabled. > +net.core.bpf_jit_harden = 2 > -- > 2.26.2 >
Hello Michael, thanks for your reply. Usually, I do not include shipping details or instructions to my patches, since they made things less flexible and I failed to be consistent here. Sorry for causing additional workload on your side here. Thanks, and best regards, Peter Müller > Hello, > > Thanks for the patch, but this broken shipping the files which I hopefully fixed properly here: > > https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=7ae1dcb33e27d2ea354acd6e7093741781e4092d > > Best, > -Michael > >> On 9 Apr 2021, at 20:13, Peter Müller <peter.mueller@ipfire.org> wrote: >> >> The second version of this patch splits this up into different >> architecture-specific sysctl config files, as i586 does not support BPF >> JIT, hence the net.core.bpf_jit_harden does not exist on that >> architecture. >> >> Fixes: #12384 >> >> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> >> --- >> config/etc/sysctl-aarch64.conf | 2 ++ >> config/etc/sysctl-armv5tel.conf | 2 ++ >> config/etc/sysctl-x86_64.conf | 3 +++ >> 3 files changed, 7 insertions(+) >> create mode 100644 config/etc/sysctl-aarch64.conf >> create mode 100644 config/etc/sysctl-armv5tel.conf >> >> diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf >> new file mode 100644 >> index 000000000..9f840806d >> --- /dev/null >> +++ b/config/etc/sysctl-aarch64.conf >> @@ -0,0 +1,2 @@ >> +# Turn on BPF JIT hardening, if the JIT is enabled. >> +net.core.bpf_jit_harden = 2 >> diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf >> new file mode 100644 >> index 000000000..9f840806d >> --- /dev/null >> +++ b/config/etc/sysctl-armv5tel.conf >> @@ -0,0 +1,2 @@ >> +# Turn on BPF JIT hardening, if the JIT is enabled. >> +net.core.bpf_jit_harden = 2 >> diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf >> index 7384bed51..c7abecc5d 100644 >> --- a/config/etc/sysctl-x86_64.conf >> +++ b/config/etc/sysctl-x86_64.conf >> @@ -1,3 +1,6 @@ >> # Improve KASLR effectiveness for mmap >> vm.mmap_rnd_bits = 32 >> vm.mmap_rnd_compat_bits = 16 >> + >> +# Turn on BPF JIT hardening, if the JIT is enabled. >> +net.core.bpf_jit_harden = 2 >> -- >> 2.26.2 >> >
Hello, > On 12 Apr 2021, at 18:58, Peter Müller <peter.mueller@ipfire.org> wrote: > > Hello Michael, > > thanks for your reply. > > Usually, I do not include shipping details or instructions to my patches, since they made things less > flexible and I failed to be consistent here. Sorry for causing additional workload on your side here. That is true for the core update files, but this was in the root files which generally are being updated by patches. -Michael > > Thanks, and best regards, > Peter Müller > > >> Hello, >> >> Thanks for the patch, but this broken shipping the files which I hopefully fixed properly here: >> >> https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=7ae1dcb33e27d2ea354acd6e7093741781e4092d >> >> Best, >> -Michael >> >>> On 9 Apr 2021, at 20:13, Peter Müller <peter.mueller@ipfire.org> wrote: >>> >>> The second version of this patch splits this up into different >>> architecture-specific sysctl config files, as i586 does not support BPF >>> JIT, hence the net.core.bpf_jit_harden does not exist on that >>> architecture. >>> >>> Fixes: #12384 >>> >>> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> >>> --- >>> config/etc/sysctl-aarch64.conf | 2 ++ >>> config/etc/sysctl-armv5tel.conf | 2 ++ >>> config/etc/sysctl-x86_64.conf | 3 +++ >>> 3 files changed, 7 insertions(+) >>> create mode 100644 config/etc/sysctl-aarch64.conf >>> create mode 100644 config/etc/sysctl-armv5tel.conf >>> >>> diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf >>> new file mode 100644 >>> index 000000000..9f840806d >>> --- /dev/null >>> +++ b/config/etc/sysctl-aarch64.conf >>> @@ -0,0 +1,2 @@ >>> +# Turn on BPF JIT hardening, if the JIT is enabled. >>> +net.core.bpf_jit_harden = 2 >>> diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf >>> new file mode 100644 >>> index 000000000..9f840806d >>> --- /dev/null >>> +++ b/config/etc/sysctl-armv5tel.conf >>> @@ -0,0 +1,2 @@ >>> +# Turn on BPF JIT hardening, if the JIT is enabled. >>> +net.core.bpf_jit_harden = 2 >>> diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf >>> index 7384bed51..c7abecc5d 100644 >>> --- a/config/etc/sysctl-x86_64.conf >>> +++ b/config/etc/sysctl-x86_64.conf >>> @@ -1,3 +1,6 @@ >>> # Improve KASLR effectiveness for mmap >>> vm.mmap_rnd_bits = 32 >>> vm.mmap_rnd_compat_bits = 16 >>> + >>> +# Turn on BPF JIT hardening, if the JIT is enabled. >>> +net.core.bpf_jit_harden = 2 >>> -- >>> 2.26.2 >>> >>
diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-aarch64.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-armv5tel.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf index 7384bed51..c7abecc5d 100644 --- a/config/etc/sysctl-x86_64.conf +++ b/config/etc/sysctl-x86_64.conf @@ -1,3 +1,6 @@ # Improve KASLR effectiveness for mmap vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16 + +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2