namespace: protect bpf file system as part of ProtectKernelTunables=

It also exposes kernel objects, let's better include this in
ProtectKernelTunables=.

diff --git a/src/core/namespace.c b/src/core/namespace.c
index f605d23..705a204 100644 (file)
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -106,6 +106,7 @@ static const MountEntry protect_kernel_tunables_table[] = {
         { "/sys",                READONLY,     false },
         { "/sys/kernel/debug",   READONLY,     true  },
         { "/sys/kernel/tracing", READONLY,     true  },
+        { "/sys/fs/bpf",         READONLY,     true  },
         { "/sys/fs/cgroup",      READWRITE,    false }, /* READONLY is set by ProtectControlGroups= option */
         { "/sys/fs/selinux",     READWRITE,    true  },
 };