Ensure unprivileged eBPF is disabled

높음레벨 1자동azure-container-linux

설명

eBPF (extended Berkeley Packet Filter) allows programs to be loaded and executed within kernel context. Unprivileged users should not be able to load eBPF programs. On Azure Container Linux the kernel parameter kernel.unprivileged_bpf_disabled is set to 1.

점검 방법

감사 방식: 셸 명령

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.unprivileged_bpf_disabled 1; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: kernel.unprivileged_bpf_disabled = 1 Example: # printf '%s\n' "kernel.unprivileged_bpf_disabled = 1" >> /etc/sysctl.d/60- kernel_sysctl.conf Run the following command to set the active kernel parameter: # sysctl -w kernel.unprivileged_bpf_disabled=1

속성

운영 체제: 모두
태그: azure-container-linuxcis-convertedkernelsysctl
참고 자료: CIS Azure Container Linux Benchmark v1.0.0 - 1.4.8 Ensure unprivileged eBPF is disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target azure-container-linux