The second version of this patch splits this up into different architecture-specific sysctl config files, as i586 does not support BPF JIT, hence the net.core.bpf_jit_harden does not exist on that architecture.
Fixes: #12384
Signed-off-by: Peter Müller peter.mueller@ipfire.org --- config/etc/sysctl-aarch64.conf | 2 ++ config/etc/sysctl-armv5tel.conf | 2 ++ config/etc/sysctl-x86_64.conf | 3 +++ 3 files changed, 7 insertions(+) create mode 100644 config/etc/sysctl-aarch64.conf create mode 100644 config/etc/sysctl-armv5tel.conf
diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-aarch64.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-armv5tel.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf index 7384bed51..c7abecc5d 100644 --- a/config/etc/sysctl-x86_64.conf +++ b/config/etc/sysctl-x86_64.conf @@ -1,3 +1,6 @@ # Improve KASLR effectiveness for mmap vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16 + +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2
Hello,
Thanks for the patch, but this broken shipping the files which I hopefully fixed properly here:
https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=7ae1dcb33e27d2ea354a...
Best, -Michael
On 9 Apr 2021, at 20:13, Peter Müller peter.mueller@ipfire.org wrote:
The second version of this patch splits this up into different architecture-specific sysctl config files, as i586 does not support BPF JIT, hence the net.core.bpf_jit_harden does not exist on that architecture.
Fixes: #12384
Signed-off-by: Peter Müller peter.mueller@ipfire.org
config/etc/sysctl-aarch64.conf | 2 ++ config/etc/sysctl-armv5tel.conf | 2 ++ config/etc/sysctl-x86_64.conf | 3 +++ 3 files changed, 7 insertions(+) create mode 100644 config/etc/sysctl-aarch64.conf create mode 100644 config/etc/sysctl-armv5tel.conf
diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-aarch64.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-armv5tel.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf index 7384bed51..c7abecc5d 100644 --- a/config/etc/sysctl-x86_64.conf +++ b/config/etc/sysctl-x86_64.conf @@ -1,3 +1,6 @@ # Improve KASLR effectiveness for mmap vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16
+# Turn on BPF JIT hardening, if the JIT is enabled.
+net.core.bpf_jit_harden = 2
2.26.2
Hello Michael,
thanks for your reply.
Usually, I do not include shipping details or instructions to my patches, since they made things less flexible and I failed to be consistent here. Sorry for causing additional workload on your side here.
Thanks, and best regards, Peter Müller
Hello,
Thanks for the patch, but this broken shipping the files which I hopefully fixed properly here:
https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=7ae1dcb33e27d2ea354a...
Best, -Michael
On 9 Apr 2021, at 20:13, Peter Müller peter.mueller@ipfire.org wrote:
The second version of this patch splits this up into different architecture-specific sysctl config files, as i586 does not support BPF JIT, hence the net.core.bpf_jit_harden does not exist on that architecture.
Fixes: #12384
Signed-off-by: Peter Müller peter.mueller@ipfire.org
config/etc/sysctl-aarch64.conf | 2 ++ config/etc/sysctl-armv5tel.conf | 2 ++ config/etc/sysctl-x86_64.conf | 3 +++ 3 files changed, 7 insertions(+) create mode 100644 config/etc/sysctl-aarch64.conf create mode 100644 config/etc/sysctl-armv5tel.conf
diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-aarch64.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-armv5tel.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf index 7384bed51..c7abecc5d 100644 --- a/config/etc/sysctl-x86_64.conf +++ b/config/etc/sysctl-x86_64.conf @@ -1,3 +1,6 @@ # Improve KASLR effectiveness for mmap vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16
+# Turn on BPF JIT hardening, if the JIT is enabled.
+net.core.bpf_jit_harden = 2
2.26.2
Hello,
On 12 Apr 2021, at 18:58, Peter Müller peter.mueller@ipfire.org wrote:
Hello Michael,
thanks for your reply.
Usually, I do not include shipping details or instructions to my patches, since they made things less flexible and I failed to be consistent here. Sorry for causing additional workload on your side here.
That is true for the core update files, but this was in the root files which generally are being updated by patches.
-Michael
Thanks, and best regards, Peter Müller
Hello,
Thanks for the patch, but this broken shipping the files which I hopefully fixed properly here:
https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=7ae1dcb33e27d2ea354a...
Best, -Michael
On 9 Apr 2021, at 20:13, Peter Müller peter.mueller@ipfire.org wrote:
The second version of this patch splits this up into different architecture-specific sysctl config files, as i586 does not support BPF JIT, hence the net.core.bpf_jit_harden does not exist on that architecture.
Fixes: #12384
Signed-off-by: Peter Müller peter.mueller@ipfire.org
config/etc/sysctl-aarch64.conf | 2 ++ config/etc/sysctl-armv5tel.conf | 2 ++ config/etc/sysctl-x86_64.conf | 3 +++ 3 files changed, 7 insertions(+) create mode 100644 config/etc/sysctl-aarch64.conf create mode 100644 config/etc/sysctl-armv5tel.conf
diff --git a/config/etc/sysctl-aarch64.conf b/config/etc/sysctl-aarch64.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-aarch64.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-armv5tel.conf b/config/etc/sysctl-armv5tel.conf new file mode 100644 index 000000000..9f840806d --- /dev/null +++ b/config/etc/sysctl-armv5tel.conf @@ -0,0 +1,2 @@ +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 diff --git a/config/etc/sysctl-x86_64.conf b/config/etc/sysctl-x86_64.conf index 7384bed51..c7abecc5d 100644 --- a/config/etc/sysctl-x86_64.conf +++ b/config/etc/sysctl-x86_64.conf @@ -1,3 +1,6 @@ # Improve KASLR effectiveness for mmap vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16
+# Turn on BPF JIT hardening, if the JIT is enabled.
+net.core.bpf_jit_harden = 2
2.26.2
-
Michael Tremer -
Peter Müller