enable BPF JIT hardening by default

GrapheneOS-Archive · Jul 5, 2023 · 65f68fd · 65f68fd
1 parent 28f5390
commit 65f68fd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
@@ -337,7 +337,7 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
 #ifdef CONFIG_BPF_JIT
 /* All BPF JIT sysctl knobs here. */
 int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
-int bpf_jit_harden   __read_mostly;
+int bpf_jit_harden   __read_mostly = 2;
 int bpf_jit_kallsyms __read_mostly;
 long bpf_jit_limit   __read_mostly;
 long bpf_jit_limit_max __read_mostly;