Skip to content
ATO Pathways
  Log In

Disable Access to Network bpf() Syscall From Unprivileged Processes

An XCCDF Rule

Description

To set the runtime status of the kernel.unprivileged_bpf_disabled kernel parameter, run the following command: 

$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: 
kernel.unprivileged_bpf_disabled = 1

Rationale

Loading and accessing the packet filters programs and maps using the bpf() syscall has the potential of revealing sensitive information about the kernel state.

ID
xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition: