Azure Container Linux
TMA-AZURE-CONTAINER-LINUX-1.4.8
Ensure unprivileged eBPF is disabled
Beschreibung
eBPF (extended Berkeley Packet Filter) allows programs to be loaded and executed within kernel context. Unprivileged users should not be able to load eBPF programs. On Azure Container Linux the kernel parameter kernel.unprivileged_bpf_disabled is set to 1.
So wird geprüft
Prüfmethode: Shell-Befehl
chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.unprivileged_bpf_disabled 1; then echo compliant; fi- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: kernel.unprivileged_bpf_disabled = 1 Example: # printf '%s\n' "kernel.unprivileged_bpf_disabled = 1" >> /etc/sysctl.d/60- kernel_sysctl.conf Run the following command to set the active kernel parameter: # sysctl -w kernel.unprivileged_bpf_disabled=1
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- azure-container-linuxcis-convertedkernelsysctl
- Referenz
- CIS Azure Container Linux Benchmark v1.0.0 - 1.4.8 Ensure unprivileged eBPF is disabled
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target azure-container-linux