Harden the eBPF compiler

Why it matters

eBPF programs are turned into machine code by a just-in-time compiler. An attacker who can load a program may craft constants inside it so that, read from a different offset, they become instructions the attacker chose. This is called JIT spraying, and hardening is meant to stop it.

How it works

Sets net.core.bpf_jit_harden to 2. Hardening such as constant blinding is then applied to eBPF programs from all users, not just unprivileged ones. The kernel documentation notes that this costs some performance and that it applies when the JIT is in use.

Who should use it

A cheap precaution for nearly everyone. Hosts that run heavy eBPF packet processing and care about every bit of speed may prefer to measure first.

What you may notice

Usually nothing. eBPF programs can run slightly slower, which only shows on heavily loaded networking or tracing setups.

Check it on your computer

Read the current value:

sysctl net.core.bpf_jit_harden

A stricter value than this one is also fine.

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.core.bpf_jit_harden=2

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-bpf-jit-harden.conf <<'EOF'
net.core.bpf_jit_harden = 2
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Restrict eBPF to administrators

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

net.core.bpf_jit_harden