enable BPF JIT hardening by default (if available)

GrapheneOS · May 26, 2018 · 4a2d438 · 4a2d438
1 parent f64bcf1
commit 4a2d438
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
@@ -302,7 +302,7 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
 #ifdef CONFIG_BPF_JIT
 /* All BPF JIT sysctl knobs here. */
 int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
-int bpf_jit_harden   __read_mostly;
+int bpf_jit_harden   __read_mostly = 2;
 int bpf_jit_kallsyms __read_mostly;
 
 static __always_inline void