From da0b67c94650b4fc934316f958ddcc4e95d774bd Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Thu, 18 Jul 2019 14:00:28 +0200 Subject: [PATCH] nixos-hardened: disable unprivileged userfaultfd syscalls New in 5.2 [1] [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cefdca0a86be517bc390fc4541e3674b8e7803b0 --- nixos/modules/profiles/hardened.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index 139ced1e53be..3ff9a2b4fde0 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -124,4 +124,7 @@ with lib; # Ignore outgoing ICMP redirects (this is ipv4 only) boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false; boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false; + + # Restrict userfaultfd syscalls to processes with the SYS_PTRACE capability + boot.kernel.sysctl."vm.unprivileged_userfaultfd" = mkDefault false; }