Ensure Lockdown is configured

BajaNivel 2Automatizadabottlerocket

Descripción

Lockdown must be enabled in integrity mode. Note that this prevents unsigned kernel modules from being loaded. This could interfere with the operation of hardware or third-party software that depends on these modules. The audit reads /sys/kernel/security/lockdown and requires [integrity] to be selected. Run tmaegis on the host through the admin container root shell (sudo sheltie).

Cómo se verifica

Método de auditoría: Comando de shell

shell

v=$(cat /sys/kernel/security/lockdown 2>/dev/null) || exit 1
printf '%s\n' "$v" | grep -Fwq '[integrity]' && echo compliant || echo "lockdown: $v"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to enable Lockdown in integrity mode: # apiclient set kernel.lockdown=integrity

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: bottlerocketsystem
Referencia: CIS Bottlerocket Benchmark v1.0.0 - 1.5.2 Ensure Lockdown is configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bottlerocket --level 2