nixos/hardened: don't set kernel.unprivileged_bpf_disabled

Upstreamed in anthraxx/linux-hardened@1a3e0c283028533527595a91d9504d2b7eabc977.
4 years ago · 71bbd876b7
parent 9da578a78f
commit 71bbd876b7
1 changed files with 0 additions and 4 deletions
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -79,10 +79,6 @@ with lib;
  # Hide kptrs even for processes with CAP_SYSLOG
  boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;

-  # Unprivileged access to bpf() has been used for privilege escalation in
-  # the past
-  boot.kernel.sysctl."kernel.unprivileged_bpf_disabled" = mkDefault true;
-
  # Disable bpf() JIT (to eliminate spray attacks)
  boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;