Ensure unprivileged eBPF is disabled

YüksekDüzey 1Otomatikazure-container-linux

Açıklama

eBPF (extended Berkeley Packet Filter) allows programs to be loaded and executed within kernel context. Unprivileged users should not be able to load eBPF programs. On Azure Container Linux the kernel parameter kernel.unprivileged_bpf_disabled is set to 1.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.unprivileged_bpf_disabled 1; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: kernel.unprivileged_bpf_disabled = 1 Example: # printf '%s\n' "kernel.unprivileged_bpf_disabled = 1" >> /etc/sysctl.d/60- kernel_sysctl.conf Run the following command to set the active kernel parameter: # sysctl -w kernel.unprivileged_bpf_disabled=1

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: azure-container-linuxcis-convertedkernelsysctl
Referans: CIS Azure Container Linux Benchmark v1.0.0 - 1.4.8 Ensure unprivileged eBPF is disabled

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target azure-container-linux