Disable vsyscalls
An XCCDF Rule
Description
To disable use of virtual syscalls,
add the argument vsyscall=none to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain vsyscall=none as follows:
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) vsyscall=none"
Rationale
Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer.
- ID
- xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
- Severity
- Medium
- Updated
Remediation - OS Build Blueprint
[customizations.kernel]
append = "vsyscall=none"
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- NIST-800-53-CM-7(a)
- grub2_vsyscall_argument
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
grubby --update-kernel=ALL --args=vsyscall=none
else