Ensure Lockdown is configured

RendahLevel 2Otomatisbottlerocket

Deskripsi

Lockdown must be enabled in integrity mode. Note that this prevents unsigned kernel modules from being loaded. This could interfere with the operation of hardware or third-party software that depends on these modules. The audit reads /sys/kernel/security/lockdown and requires [integrity] to be selected. Run tmaegis on the host through the admin container root shell (sudo sheltie).

Cara pemeriksaan

Metode audit: Perintah shell

shell

v=$(cat /sys/kernel/security/lockdown 2>/dev/null) || exit 1
printf '%s\n' "$v" | grep -Fwq '[integrity]' && echo compliant || echo "lockdown: $v"

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to enable Lockdown in integrity mode: # apiclient set kernel.lockdown=integrity

Properti

Sistem operasi: Apa saja
Tag: bottlerocketsystem
Referensi: CIS Bottlerocket Benchmark v1.0.0 - 1.5.2 Ensure Lockdown is configured

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target bottlerocket --level 2