# Sensible default sysctl settings.
# You can override these by putting your own config files in
# @sysconfdir@/sysctl.d.

# Use CoDel packet scheduler
net.core.default_qdisc = fq_codel

# Use RFC4941 random addresses for IPv6 interface (not MAC address)
net.ipv6.conf.default.use_tempaddr = 1
net.ipv6.conf.all.use_tempaddr = 1

# Ignore obviously-silly ICMP
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# grsecurity-style link restrictions
fs.protected_hardlinks = 1
fs.protected_symlinks = 1

# Don't reveal kernel function addresses to non-root
kernel.kptr_restrict = 1
kernel.dmesg_restrict = 1

# Don't allow unprivileged users to use bpf(), and enable hardening
kernel.unprivileged_bpf_disabled = 1
net.core.bpf_jit_harden = 1

# Don't allow unprivileged users to use userfaultfd()
vm.unprivileged_userfaultfd = 0
