pkg/sysctl: Prevent ebpf privilege escalation

On 4.9.x and 4.14.x kernels ebpf verifier bugs allow ebpf
programs to access (read/write) random memory. Setting
kernel.unprivileged_bpf_disabled=1 mitigates this somewhat
until it is fixed upstream.

See:
- https://lwn.net/Articles/742170
- https://lwn.net/Articles/742169

Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>

pkg/sysctl/etc/sysctl.d/00-linuxkit.conf

@@ -26,3 +26,6 @@ kernel.dmesg_restrict = 1
 kernel.perf_event_paranoid = 3
 fs.protected_hardlinks = 1
 fs.protected_symlinks = 1
+# Prevent ebpf privilege escalation
+# see: https://lwn.net/Articles/742170
+kernel.unprivileged_bpf_disabled=1