| # /etc/sysctl.conf |
| # Copyright 2016 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| # |
| # For more information on how this file works, please see |
| # the manpages sysctl(8) and sysctl.conf(5). |
| # |
| # In order for this file to work properly, you must first |
| # enable 'Sysctl support' in the kernel. |
| # |
| # Look in /proc/sys/ for all the things you can setup. |
| # |
| |
| # |
| # Original Gentoo settings: |
| # |
| |
| # Enables source route verification |
| net.ipv4.conf.default.rp_filter = 1 |
| # Enable reverse path |
| net.ipv4.conf.all.rp_filter = 1 |
| |
| # Enable SYN cookies (yum!) |
| # http://cr.yp.to/syncookies.html |
| net.ipv4.tcp_syncookies = 1 |
| |
| # Disable source route |
| net.ipv4.conf.all.accept_source_route = 0 |
| net.ipv4.conf.default.accept_source_route = 0 |
| |
| # Disable redirects |
| net.ipv4.conf.all.accept_redirects = 0 |
| net.ipv4.conf.default.accept_redirects = 0 |
| |
| # Ignore ICMP redirects from non-GW hosts |
| net.ipv4.conf.all.secure_redirects = 1 |
| net.ipv4.conf.default.secure_redirects = 1 |
| |
| # Don't allow traffic between networks or act as a router |
| net.ipv4.conf.all.send_redirects = 0 |
| net.ipv4.conf.default.send_redirects = 0 |
| |
| # Ignore ICMP broadcasts |
| net.ipv4.icmp_echo_ignore_broadcasts = 1 |
| |
| # Ignore bad ICMP errors |
| net.ipv4.icmp_ignore_bogus_error_responses = 1 |
| |
| # Perform PLPMTUD only after detecting a "blackhole" in old-style PMTUD |
| net.ipv4.tcp_mtu_probing = 1 |
| |
| # Implement RFC 1337 fix |
| net.ipv4.tcp_rfc1337 = 1 |
| |
| # Randomize addresses of mmap base, heap, stack and VDSO page |
| kernel.randomize_va_space = 2 |
| |
| # |
| # ChromeOS specific settings: |
| # |
| |
| # Disable shrinking the cwnd when connection is idle |
| net.ipv4.tcp_slow_start_after_idle = 0 |
| |
| # Allow the TCP fastopen flag to be used |
| net.ipv4.tcp_fastopen = 1 |
| |
| # Allow full memory overcommit as we rather close or kill tabs than |
| # refuse memory to arbitrary core processes. |
| vm.overcommit_memory = 1 |
| |
| vm.laptop_mode = 0 |
| |
| # Disable kernel address visibility to non-root users. |
| kernel.kptr_restrict = 1 |
| |
| # Enable crash reporting for setuid programs too. |
| fs.suid_dumpable = 2 |
| |
| # Provide protection from ToCToU races |
| fs.protected_symlinks = 1 |
| fs.protected_hardlinks = 1 |
| |
| # Ptrace protections |
| kernel.yama.ptrace_scope=1 |
| |
| # Perf only available to root |
| kernel.perf_event_paranoid=2 |
| |
| # Enable printing the backtrace of all CPUs after a softlockup. |
| kernel.softlockup_all_cpu_backtrace = 1 |
| |
| # Enable softlockup panic. |
| kernel.softlockup_panic=1 |
| |
| # Hung task detection. |
| kernel.hung_task_panic = 0 |
| kernel.hung_task_timeout_secs = 300 |
| |
| # Disable ebpf syscall for unprivileged users. |
| kernel.unprivileged_bpf_disabled=1 |
| net.core.bpf_jit_harden=2 |
| |
| # Set pid_max to maximum allowable limit (2^22). |
| kernel.pid_max = 4194304 |
| |
| # Allow more (default is 128) inotify instances for large workloads. |
| fs.inotify.max_user_instances = 1024 |
| |
| # No longer use limit_output_bytes for paced flows. |
| # (https://github.com/torvalds/linux/commit/c73e5807e4f6fc6d373a5db55b45f639f8bb6328) |
| net.ipv4.tcp_limit_output_bytes=1048576 |
| |
| # Disable accepting router advertisements, see b/151945703. |
| net.ipv6.conf.default.accept_ra = 0 |
| |
| # Update TCP keepalive time aligning with GCP's default reply-allowed |
| # rule (10minute). See https://github.com/kubernetes/kubernetes/issues/32457 |
| # 300 + 60 * 5 = 600 before claiming a connection is broken. |
| net.ipv4.tcp_keepalive_time=300 |
| net.ipv4.tcp_keepalive_intvl=60 |
| net.ipv4.tcp_keepalive_probes=5 |
