From 944fed3c459dd55820cb1eca68f86816bdf8469f Mon Sep 17 00:00:00 2001
From: flawedworld <38294951+flawedworld@users.noreply.github.com>
Date: Fri, 18 Sep 2020 23:29:04 +0100
Subject: [PATCH] Disallow kernel profiling by users without CAP_SYS_ADMIN

It's the default on a lot of stuff, but still nice to have.
---
 etc/sysctl.d/30_security-misc.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/etc/sysctl.d/30_security-misc.conf b/etc/sysctl.d/30_security-misc.conf
index 18902ef..cb53834 100644
--- a/etc/sysctl.d/30_security-misc.conf
+++ b/etc/sysctl.d/30_security-misc.conf
@@ -145,3 +145,7 @@ vm.unprivileged_userfaultfd=0
 ## - https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Performance_Tuning_Guide/s-memory-tunables.html
 ## - https://en.wikipedia.org/wiki/Swappiness
 vm.swappiness=1
+
+## Disallow kernel profiling by users without CAP_SYS_ADMIN
+## https://www.kernel.org/doc/Documentation/sysctl/kernel.txt
+kernel.perf_event_paranoid=3