From 98bfe918122c015e18bdde035749f31b9729be13 Mon Sep 17 00:00:00 2001
From: Christoph Cullmann <christoph@cullmann.io>
Date: Sun, 30 Mar 2025 17:26:25 +0200
Subject: [PATCH] harden some stuff

---
 share/common.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/share/common.nix b/share/common.nix
index 80a58fe..a714564 100644
--- a/share/common.nix
+++ b/share/common.nix
@@ -60,6 +60,12 @@ in
 
     # allow proper perf usage
     "kernel.perf_event_mlock_kb" = 16777216;
+
+    # harden some stuff
+    "kernel.sysrq" = 0;
+    "kernel.kptr_restrict" = 2;
+    "kernel.unprivileged_bpf_disabled" = 1;
+    "net.core.bpf_jit_harden" = 2;
   };
 
   # Use the systemd-boot EFI boot loader.