Ensure kernel lockdown is configured

NiedrigStufe 2Automatisiertazure-container-linux

Beschreibung

Lockdown must be enabled in integrity mode. On Azure Container Linux, kernel lockdown is enabled in integrity mode, which restricts modification of the running kernel. Note that this prevents unsigned kernel modules from being loaded. This could interfere with the operation of hardware or third-party software that depends on these modules.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Fw '"'"'[integrity]'"'"' /sys/kernel/security/lockdown' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'none [integrity] confidentiality' || { echo step1: missing 'none [integrity] confidentiality'; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enable kernel lockdown in integrity mode via the kernel command line by adding lockdown=integrity, then rebuild and deploy the Azure Container Linux image. On ACL the setting is applied at image build time rather than at runtime.

Eigenschaften

Betriebssysteme: Beliebig
Tags: azure-container-linuxcis-converted
Referenz: CIS Azure Container Linux Benchmark v1.0.0 - 1.4.7 Ensure kernel lockdown is configured

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target azure-container-linux --level 2