Skip to content
ATO Pathways
  Log In

Harden the operation of the BPF just-in-time compiler

An XCCDF Rule

Description

To set the runtime status of the net.core.bpf_jit_harden kernel parameter, run the following command: 

$ sudo sysctl -w net.core.bpf_jit_harden=2
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: 
net.core.bpf_jit_harden = 2

Rationale

When hardened, the extended Berkeley Packet Filter just-in-time compiler will randomize any kernel addresses in the BPF programs and maps, and will not expose the JIT addresses in /proc/kallsyms.

ID
xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition: