nixos/hardened: don't set net.core.bpf_jit_harden

Upstreamed in anthraxx/linux-hardened@82e384401d441d42efad9830ab31650a7ea571db.
4 years ago · af4f57b2c4
parent 71bbd876b7
commit af4f57b2c4
1 changed files with 0 additions and 3 deletions
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -82,9 +82,6 @@ with lib;
  # Disable bpf() JIT (to eliminate spray attacks)
  boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;

-  # ... or at least apply some hardening to it
-  boot.kernel.sysctl."net.core.bpf_jit_harden" = mkDefault true;
-
  # Raise ASLR entropy for 64bit & 32bit, respectively.
  #
  # Note: mmap_rnd_compat_bits may not exist on 64bit.