From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: Re: [PATCH] sysctl.conf: Turn on BPF JIT hardening, if the JIT is enabled Date: Tue, 09 Jun 2020 18:00:50 +0000 Message-ID: <7e6697a9-62f1-95b1-fdc4-d16a7f7825bf@ipfire.org> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0530120840802830131==" List-Id: --===============0530120840802830131== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Michael, > Hi Peter, >=20 >> On 7 Jun 2020, at 18:02, Peter M=C3=BCller wr= ote: >> >> This is recommended by the Kernel Self Protection Project, and although >> we do not take advantage of the BPF JIT at this time, we should set this >> nevertheless in order to avoid potential security vulnerabilities. >=20 > I do not really understand what you are trying to achieve here. I am trying to achieve enabling of BPF JIT hardening. > Please state more clearly *why* you think this is a useful change for IPFir= e. > > As far as I am aware, the kernel internally uses BPF. Yes, to my knowledge, this is exactly the point. The Kernel is using it, and we should make sure it is properly hardened then. If this sysctl is helping, I do not see a reason why not turning it on. Thanks, and best regards, Peter M=C3=BCller > -Michael >=20 > P.S. How the f*** is this not already the default in the Linux kernel? Perf= ormance only, eh? >=20 >> >> Fixes: #12384 >> >> Signed-off-by: Peter M=C3=BCller >> --- >> config/etc/sysctl.conf | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf >> index 7e7ebee44..3f4c828f9 100644 >> --- a/config/etc/sysctl.conf >> +++ b/config/etc/sysctl.conf >> @@ -49,6 +49,9 @@ kernel.dmesg_restrict =3D 1 >> fs.protected_symlinks =3D 1 >> fs.protected_hardlinks =3D 1 >> >> +# Turn on BPF JIT hardening, if the JIT is enabled. >> +net.core.bpf_jit_harden =3D 2 >> + >> # Minimal preemption granularity for CPU-bound tasks: >> # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) >> kernel.sched_min_granularity_ns =3D 10000000 >> --=20 >> 2.26.2 >=20 --===============0530120840802830131==--