blob: ecc096e3dde4626c1ed2a0dae537cc760c861004 [file] [log] [blame]
# /etc/sysctl.conf
# Copyright 2016 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# For more information on how this file works, please see
# the manpages sysctl(8) and sysctl.conf(5).
#
# In order for this file to work properly, you must first
# enable 'Sysctl support' in the kernel.
#
# Look in /proc/sys/ for all the things you can setup.
#
#
# Original Gentoo settings:
#
# Enables source route verification
net.ipv4.conf.default.rp_filter = 1
# Enable reverse path
net.ipv4.conf.all.rp_filter = 1
# Enable SYN cookies (yum!)
# http://cr.yp.to/syncookies.html
net.ipv4.tcp_syncookies = 1
# Disable source route
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# Disable redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
# Ignore ICMP redirects from non-GW hosts
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.default.secure_redirects = 1
# Don't allow traffic between networks or act as a router
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
# Ignore ICMP broadcasts
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Ignore bad ICMP errors
net.ipv4.icmp_ignore_bogus_error_responses = 1
# Perform PLPMTUD only after detecting a "blackhole" in old-style PMTUD
net.ipv4.tcp_mtu_probing = 1
# Implement RFC 1337 fix
net.ipv4.tcp_rfc1337 = 1
# Randomize addresses of mmap base, heap, stack and VDSO page
kernel.randomize_va_space = 2
#
# ChromeOS specific settings:
#
# Disable shrinking the cwnd when connection is idle
net.ipv4.tcp_slow_start_after_idle = 0
# Allow the TCP fastopen flag to be used
net.ipv4.tcp_fastopen = 1
# Allow full memory overcommit as we rather close or kill tabs than
# refuse memory to arbitrary core processes.
vm.overcommit_memory = 1
vm.laptop_mode = 0
# Disable kernel address visibility to non-root users.
kernel.kptr_restrict = 1
# Enable crash reporting for setuid programs too.
fs.suid_dumpable = 2
# Provide protection from ToCToU races
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
# Ptrace protections
kernel.yama.ptrace_scope=1
# Perf only available to root
kernel.perf_event_paranoid=2
# Enable printing the backtrace of all CPUs after a softlockup.
kernel.softlockup_all_cpu_backtrace = 1
# Enable softlockup panic.
kernel.softlockup_panic=1
# Hung task detection.
kernel.hung_task_panic = 1
kernel.hung_task_timeout_secs = 300
# Disable ebpf syscall for unprivileged users.
kernel.unprivileged_bpf_disabled=1
net.core.bpf_jit_harden=2
# Set pid_max to maximum allowable limit (2^22).
kernel.pid_max = 4194304
# Allow more (default is 128) inotify instances for large workloads.
fs.inotify.max_user_instances = 1024