enable BPF JIT hardening by default (if available)

anthraxx · Apr 4, 2020 · 82e3844 · 82e3844
1 parent 1a3e0c2
commit 82e3844
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
@@ -520,7 +520,7 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
 /* All BPF JIT sysctl knobs here. */
 int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
 int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
-int bpf_jit_harden   __read_mostly;
+int bpf_jit_harden   __read_mostly = 2;
 long bpf_jit_limit   __read_mostly;
 
 static __always_inline void