TMA-AZURE-CONTAINER-LINUX-1.4.7

Ensure kernel lockdown is configured

NiskaNivo 2Automatskaazure-container-linux

Opis

Lockdown must be enabled in integrity mode. On Azure Container Linux, kernel lockdown is enabled in integrity mode, which restricts modification of the running kernel. Note that this prevents unsigned kernel modules from being loaded. This could interfere with the operation of hardware or third-party software that depends on these modules.

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Fw '"'"'[integrity]'"'"' /sys/kernel/security/lockdown' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'none [integrity] confidentiality' || { echo step1: missing 'none [integrity] confidentiality'; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Enable kernel lockdown in integrity mode via the kernel command line by adding lockdown=integrity, then rebuild and deploy the Azure Container Linux image. On ACL the setting is applied at image build time rather than at runtime.

Svojstva

Operativni sistemi: Bilo koji
Oznake: azure-container-linuxcis-converted
Referenca: CIS Azure Container Linux Benchmark v1.0.0 - 1.4.7 Ensure kernel lockdown is configured

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target azure-container-linux --level 2