From 46dfb2d0904ecd1895af7e378b7d134f45c4e762 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Thu, 26 Sep 2019 10:07:35 +0100 Subject: [PATCH] nixos/sysctl: reduce prio of "kernel.kptr_restrict" to mkDefault Users should be able to override this value without having to use mkForce. --- nixos/modules/config/sysctl.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index fb2b58eed72..e59c7a32c28 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -54,7 +54,7 @@ in # Hide kernel pointers (e.g. in /proc/modules) for unprivileged # users as these make it easier to exploit kernel vulnerabilities. - boot.kernel.sysctl."kernel.kptr_restrict" = 1; + boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1; # Disable YAMA by default to allow easy debugging. boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;