Skip to content
ATO Pathways
  Log In

Disable Kernel Image Loading

An XCCDF Rule

Description

To set the runtime status of the kernel.kexec_load_disabled kernel parameter, run the following command: 

$ sudo sysctl -w kernel.kexec_load_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: 
kernel.kexec_load_disabled = 1

Rationale

Disabling kexec_load allows greater control of the kernel memory. It makes it impossible to load another kernel image after it has been disabled.

ID
xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition: