pkg/sysctl: Prevent ebpf privilege escalation
On 4.9.x and 4.14.x kernels ebpf verifier bugs allow ebpf
programs to access (read/write) random memory. Setting
kernel.unprivileged_bpf_disabled=1 mitigates this somewhat
until it is fixed upstream.
See:
@@ -26,3 +26,6 @@ kernel.dmesg_restrict = 1
kernel.perf_event_paranoid = 3
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
+# Prevent ebpf privilege escalation
+# see: https://lwn.net/Articles/742170
+kernel.unprivileged_bpf_disabled=1
