Locks down “BPF” which, honestly, I don’t know much about. Has something to do with firewalls?
BPF (more importantly it’s successor, eBPF) allows (very specific, automatically verified) programs to run in kernel space, triggered by various events. Mostly used for networking stuff.