nixos-hardened: disable unprivileged userfaultfd syscalls
New in 5.2 [1] [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cefdca0a86be517bc390fc4541e3674b8e7803b0
This commit is contained in:
parent
4b21d1ac8c
commit
da0b67c946
|
@ -124,4 +124,7 @@ with lib;
|
|||
# Ignore outgoing ICMP redirects (this is ipv4 only)
|
||||
boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
|
||||
|
||||
# Restrict userfaultfd syscalls to processes with the SYS_PTRACE capability
|
||||
boot.kernel.sysctl."vm.unprivileged_userfaultfd" = mkDefault false;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue