From patchwork Sun Jun 7 17:02:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 3164 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 49g2kV4NZKz43yv for ; Sun, 7 Jun 2020 17:02:42 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 49g2kT4y4Nz1WF; Sun, 7 Jun 2020 17:02:41 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 49g2kT3NXbz2ymZ; Sun, 7 Jun 2020 17:02:41 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 49g2kS1kRZz2xJ9 for ; Sun, 7 Jun 2020 17:02:40 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 49g2kQ5lnzzWr for ; Sun, 7 Jun 2020 17:02:38 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1591549359; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TM4rfKwBMrRLnrFgCLXisiZSzyrzEye65emSFXOLoCE=; b=+GPWIjdOGAzjdcHTYwX8RCCuq1aAW2a7XUNxfc7Xpn5YI+Fa+fKP7JCgaxlVfns2mh9aCS aK9MmVxAmjXPjDAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1591549359; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TM4rfKwBMrRLnrFgCLXisiZSzyrzEye65emSFXOLoCE=; b=AL1/x+SEjKEdMIZUwocyIfAlct8ywfgh8Q94UbsUhEI/McFiOz8ztai94gABCOQIA//qff XHAxCfom+XwYxKOA18HaM4dLQqdb8wVi4F2sZNzMDeAyVygjhBNLij9Z3s4/yLCFJ2yPS4 2SDUP0JTlfgtkwMtakYTXEWIrWUu6fA+iUPFLS5fYY+uAUMjfrbUM9vRji8W25jQtb/0Vj cTkl7RsSDQ+GunzujYQQK1XgEzc2LQbOxPExLV79WgDN4KssQYrPYyX8CAtQeBZOEQrWDU Q+OlmUZX9VIrWhxJg5lDpVdqGf6GTzANJhl64/1Z+6dB0ra2sl+swbNjrUZCkA== To: development@lists.ipfire.org From: =?utf-8?q?Peter_M=C3=BCller?= Subject: [PATCH] sysctl.conf: Turn on BPF JIT hardening, if the JIT is enabled Message-ID: <80294752-603e-be9a-9faf-5348116d3e09@ipfire.org> Date: Sun, 7 Jun 2020 17:02:33 +0000 MIME-Version: 1.0 Content-Language: en-US Authentication-Results: mail01.ipfire.org; auth=pass smtp.mailfrom=peter.mueller@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This is recommended by the Kernel Self Protection Project, and although we do not take advantage of the BPF JIT at this time, we should set this nevertheless in order to avoid potential security vulnerabilities. Fixes: #12384 Signed-off-by: Peter Müller --- config/etc/sysctl.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 7e7ebee44..3f4c828f9 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -49,6 +49,9 @@ kernel.dmesg_restrict = 1 fs.protected_symlinks = 1 fs.protected_hardlinks = 1 +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 + # Minimal preemption granularity for CPU-bound tasks: # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) kernel.sched_min_granularity_ns = 10000000