Ensure kernel lockdown is configured

FaibleNiveau 2Automatiséeazure-container-linux

Description

Lockdown must be enabled in integrity mode. On Azure Container Linux, kernel lockdown is enabled in integrity mode, which restricts modification of the running kernel. Note that this prevents unsigned kernel modules from being loaded. This could interfere with the operation of hardware or third-party software that depends on these modules.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Fw '"'"'[integrity]'"'"' /sys/kernel/security/lockdown' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'none [integrity] confidentiality' || { echo step1: missing 'none [integrity] confidentiality'; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Enable kernel lockdown in integrity mode via the kernel command line by adding lockdown=integrity, then rebuild and deploy the Azure Container Linux image. On ACL the setting is applied at image build time rather than at runtime.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: azure-container-linuxcis-converted
Référence: CIS Azure Container Linux Benchmark v1.0.0 - 1.4.7 Ensure kernel lockdown is configured

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target azure-container-linux --level 2