diff mbox series

sysctl: Disable bpf() calls from unprivileged users without toggle option

Message ID fd80daa9-6a34-425e-9b86-cab27aa6ce0a@ipfire.org
State New
Headers
Series sysctl: Disable bpf() calls from unprivileged users without toggle option |

Commit Message

Peter Müller June 16, 2024, 2:02 p.m. UTC 
  According to the Linux kernel documentation, enabling BPF_UNPRIV_DEFAULT_OFF
(which was done in 69dde418f11dc0085cbe061b90f6c002d6d6cce2) will cause
the sysctl kernel.unprivileged_bpf_disabled to default to 2. This
prohibits calls to bpf() from unprivileged users by default, but allows
for such calls to be allowed again during runtime, by setting
kernel.unprivileged_bpf_disabled to 0.

There is no legitimate reason why this should be possible on IPFire,
which is why this patch sets kernel.unprivileged_bpf_disabled to 1
during startup, causing the same effect as 2, but without any option to
revert this setting during runtime. This fixes a Lynis warning.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 config/etc/sysctl.conf | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
index 31a220e38..51a804043 100644
--- a/config/etc/sysctl.conf
+++ b/config/etc/sysctl.conf
@@ -111,3 +111,6 @@  kernel.perf_event_paranoid = 3
 
 # Only processes with CAP_SYS_PTRACE may use ptrace
 kernel.yama.ptrace_scope = 2
+
+# Disable unprivileged calls to bpf() without option to enable during runtime
+kernel.unprivileged_bpf_disabled = 1