Skip to content
ATO Pathways
  Log In

Disable vsyscalls

An XCCDF Rule

Description

To disable use of virtual syscalls, add the argument vsyscall=none to all BLS (Boot Loader Specification) entries ('options' line) for the Linux operating system in /boot/loader/entries/*.conf.

Rationale

Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer.

ID
xccdf_org.ssgproject.content_rule_coreos_vsyscall_kernel_argument
Severity
Medium
References
Updated



Remediation - Kubernetes Patch


apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition: