gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #256159 from YtvwlD/yama

Browse Source 
nixos/sysctl: Stop disabling yama by default
This commit is contained in:
Thiago Kenji Okada
2023-11-26 10:32:32 +00:00
committed by GitHub
parent 26dc877716 1ee5a5b6ed
commit e6e0787c3f
3 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/config/sysctl.nix
View File

@@ -69,9 +69,6 @@ in
# users as these make it easier to exploit kernel vulnerabilities.
boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
# Disable YAMA by default to allow easy debugging.
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
# Improve compatibility with applications that allocate
# a lot of memory, like modern games
boot.kernel.sysctl."vm.max_map_count" = mkDefault 1048576;

4
nixos/modules/profiles/hardened.nix
View File

@@ -79,10 +79,6 @@ with lib;
"ufs"
];
# Restrict ptrace() usage to processes with a pre-defined relationship
# (e.g., parent/child)
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
# Hide kptrs even for processes with CAP_SYSLOG
boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;