Ensure unprivileged eBPF is disabled

VisokaNivo 1Automatskaazure-container-linux

Opis

eBPF (extended Berkeley Packet Filter) allows programs to be loaded and executed within kernel context. Unprivileged users should not be able to load eBPF programs. On Azure Container Linux the kernel parameter kernel.unprivileged_bpf_disabled is set to 1.

Kako se proverava

Metod provere: Komanda ljuske

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.unprivileged_bpf_disabled 1; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: kernel.unprivileged_bpf_disabled = 1 Example: # printf '%s\n' "kernel.unprivileged_bpf_disabled = 1" >> /etc/sysctl.d/60- kernel_sysctl.conf Run the following command to set the active kernel parameter: # sysctl -w kernel.unprivileged_bpf_disabled=1

Svojstva

Operativni sistemi: Bilo koji
Oznake: azure-container-linuxcis-convertedkernelsysctl
Referenca: CIS Azure Container Linux Benchmark v1.0.0 - 1.4.8 Ensure unprivileged eBPF is disabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target azure-container-linux