nixos/sysctl: reduce prio of "kernel.kptr_restrict" to mkDefault

Users should be able to override this value without having to use mkForce.
This commit is contained in:
Jörg Thalheim 2019-09-26 10:07:35 +01:00
parent 954220b341
commit 46dfb2d090
No known key found for this signature in database
GPG key ID: B3F5D81B0C6967C4

View file

@ -54,7 +54,7 @@ in
# Hide kernel pointers (e.g. in /proc/modules) for unprivileged
# users as these make it easier to exploit kernel vulnerabilities.
boot.kernel.sysctl."kernel.kptr_restrict" = 1;
boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
# Disable YAMA by default to allow easy debugging.
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;