disable unprivileged BPF loading

diff --git a/modules/debian_org/manifests/init.pp b/modules/debian_org/manifests/init.pp
index b94e2a7..616be75 100644 (file)
--- a/modules/debian_org/manifests/init.pp
+++ b/modules/debian_org/manifests/init.pp
@@ -329,4 +329,11 @@ class debian_org {
                        package { 'irqbalance': ensure => installed }
                }
        }
+
+
+       # https://www.decadent.org.uk/ben/blog/bpf-security-issues-in-debian.html
+       site::sysctl { 'unprivileged_bpf_disabled':
+               key   => 'kernel.unprivileged_bpf_disabled',
+               value => '1',
+       }
 }