Lock down kernel on buster #986
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Errored hosts (0)Changed hosts (8)Unaffected hosts (89)Changed hostsdiff for bedbugs.ocf.berkeley.edu, jaws.ocf.berkeley.edu, pandemic.ocf.berkeley.edu, tornado.ocf.berkeley.edu*******************************************
+ Package[lockdown] =>
parameters =>
"allow_virtual": false
*******************************************diff for flood.ocf.berkeley.edu, quarantine.ocf.berkeley.edu, spectre.ocf.berkeley.edu, trojan.ocf.berkeley.edu*******************************************
+ Package[linux-image-amd64] =>
parameters =>
"allow_virtual": false,
"ensure": "purged"
*******************************************
+ Package[linux-image-cloud-amd64] =>
parameters =>
"allow_virtual": false
*******************************************
+ Package[lockdown] =>
parameters =>
"allow_virtual": false
*******************************************Unaffected hosts |
|
The changes look good to me but I would like to canary this on a VM and physical host first before merging to avoid potential issues. Thanks! |
|
Why would we want to disable BPF? |
Disable some kernel features: module loading after boot, kexec, Berkeley Packet Filter (BPF). Also install cloud kernel image on VMs which removes some hardware support. Benefits: slightly faster boot and reduced attack surface.
Errored hosts (0)Changed hosts (36)Unaffected hosts (62)Changed hostsdiff for acid.ocf.berkeley.edu, arsenic.ocf.berkeley.edu, asteroid.ocf.berkeley.edu, avalanche.ocf.berkeley.edu, bigbang.ocf.berkeley.edu, blackout.ocf.berkeley.edu, blight.ocf.berkeley.edu, blizzard.ocf.berkeley.edu, cyanide.ocf.berkeley.edu, destruction.ocf.berkeley.edu, drought.ocf.berkeley.edu, eruption.ocf.berkeley.edu, famine.ocf.berkeley.edu, firewhirl.ocf.berkeley.edu, hailstorm.ocf.berkeley.edu, headcrash.ocf.berkeley.edu, heatwave.ocf.berkeley.edu, invasion.ocf.berkeley.edu, madcow.ocf.berkeley.edu, meteorstorm.ocf.berkeley.edu, plague.ocf.berkeley.edu, sinkhole.ocf.berkeley.edu, surge.ocf.berkeley.edu, typhoon.ocf.berkeley.edu, venom.ocf.berkeley.edu, volcano.ocf.berkeley.edu, wildfire.ocf.berkeley.edu*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************diff for flood.ocf.berkeley.edu, maelstrom.ocf.berkeley.edu, quarantine.ocf.berkeley.edu, spectre.ocf.berkeley.edu, trojan.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
+ Package[linux-image-amd64] =>
parameters =>
"allow_virtual": false,
"ensure": "purged"
*******************************************
+ Package[linux-image-cloud-amd64] =>
parameters =>
"allow_virtual": false
*******************************************diff for tornado.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************diff for bedbugs.ocf.berkeley.edu, jaws.ocf.berkeley.edu, pandemic.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************Unaffected hosts |
Most definitely. I also replaced the lockdown package with hardening-runtime. However if the performance impact of the kernel command line options is too great we'll need to revert it.
To clarify, this doesn't disable BPF entirely, it disables unprivileged bpf() that has been a source of privilege escalation vulnerabilities, e.g., CVE-2020-8835, CVE-2017-16995, CVE-2016-4557. netfilter and seccomp-bpf predate it and shouldn't be affected. |
|
Nvm outdated question it seems |
Errored hosts (1)Changed hosts (36)Unaffected hosts (61)Errored hostserror for anthrax.ocf.berkeley.eduChanged hostsdiff for flood.ocf.berkeley.edu, maelstrom.ocf.berkeley.edu, quarantine.ocf.berkeley.edu, spectre.ocf.berkeley.edu, trojan.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
+ Package[linux-image-amd64] =>
parameters =>
"allow_virtual": false,
"ensure": "purged"
*******************************************
+ Package[linux-image-cloud-amd64] =>
parameters =>
"allow_virtual": false
*******************************************diff for bedbugs.ocf.berkeley.edu, jaws.ocf.berkeley.edu, pandemic.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************diff for acid.ocf.berkeley.edu, arsenic.ocf.berkeley.edu, asteroid.ocf.berkeley.edu, avalanche.ocf.berkeley.edu, bigbang.ocf.berkeley.edu, blackout.ocf.berkeley.edu, blight.ocf.berkeley.edu, blizzard.ocf.berkeley.edu, cyanide.ocf.berkeley.edu, destruction.ocf.berkeley.edu, drought.ocf.berkeley.edu, eruption.ocf.berkeley.edu, famine.ocf.berkeley.edu, firewhirl.ocf.berkeley.edu, hailstorm.ocf.berkeley.edu, headcrash.ocf.berkeley.edu, heatwave.ocf.berkeley.edu, invasion.ocf.berkeley.edu, madcow.ocf.berkeley.edu, meteorstorm.ocf.berkeley.edu, plague.ocf.berkeley.edu, sinkhole.ocf.berkeley.edu, surge.ocf.berkeley.edu, typhoon.ocf.berkeley.edu, venom.ocf.berkeley.edu, volcano.ocf.berkeley.edu, wildfire.ocf.berkeley.edu*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************diff for tornado.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************Unaffected hosts |
Errored hosts (0)Changed hosts (36)Unaffected hosts (62)Changed hostsdiff for flood.ocf.berkeley.edu, maelstrom.ocf.berkeley.edu, quarantine.ocf.berkeley.edu, spectre.ocf.berkeley.edu, trojan.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
+ Package[linux-image-amd64] =>
parameters =>
"allow_virtual": false,
"ensure": "purged"
*******************************************
+ Package[linux-image-cloud-amd64] =>
parameters =>
"allow_virtual": false
*******************************************diff for tornado.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************diff for bedbugs.ocf.berkeley.edu, jaws.ocf.berkeley.edu, pandemic.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************diff for acid.ocf.berkeley.edu, arsenic.ocf.berkeley.edu, asteroid.ocf.berkeley.edu, avalanche.ocf.berkeley.edu, bigbang.ocf.berkeley.edu, blackout.ocf.berkeley.edu, blight.ocf.berkeley.edu, blizzard.ocf.berkeley.edu, cyanide.ocf.berkeley.edu, destruction.ocf.berkeley.edu, drought.ocf.berkeley.edu, eruption.ocf.berkeley.edu, famine.ocf.berkeley.edu, firewhirl.ocf.berkeley.edu, hailstorm.ocf.berkeley.edu, headcrash.ocf.berkeley.edu, heatwave.ocf.berkeley.edu, invasion.ocf.berkeley.edu, madcow.ocf.berkeley.edu, meteorstorm.ocf.berkeley.edu, plague.ocf.berkeley.edu, sinkhole.ocf.berkeley.edu, surge.ocf.berkeley.edu, typhoon.ocf.berkeley.edu, venom.ocf.berkeley.edu, volcano.ocf.berkeley.edu, wildfire.ocf.berkeley.edu*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************Unaffected hosts |
|
Can we take another look at this? Would be good to test on a few dev- VMs. |
Errored hosts (6)Changed hosts (60)Unaffected hosts (8)Errored hostserror for chaos.ocf.berkeley.eduerror for cyclone.ocf.berkeley.eduerror for death.ocf.berkeley.eduerror for democracy.ocf.berkeley.eduerror for destruction.ocf.berkeley.eduerror for segfault.ocf.berkeley.eduChanged hostsdiff for acid.ocf.berkeley.edu, arsenic.ocf.berkeley.edu, asteroid.ocf.berkeley.edu, avalanche.ocf.berkeley.edu, bigbang.ocf.berkeley.edu, blackout.ocf.berkeley.edu, blight.ocf.berkeley.edu, blizzard.ocf.berkeley.edu, cyanide.ocf.berkeley.edu, drought.ocf.berkeley.edu, eruption.ocf.berkeley.edu, famine.ocf.berkeley.edu, firewhirl.ocf.berkeley.edu, hailstorm.ocf.berkeley.edu, headcrash.ocf.berkeley.edu, heatwave.ocf.berkeley.edu, hurricane.ocf.berkeley.edu, invasion.ocf.berkeley.edu, madcow.ocf.berkeley.edu, meteorstorm.ocf.berkeley.edu, outbreak.ocf.berkeley.edu, plague.ocf.berkeley.edu, sinkhole.ocf.berkeley.edu, surge.ocf.berkeley.edu, tornado.ocf.berkeley.edu, typhoon.ocf.berkeley.edu, venom.ocf.berkeley.edu, volcano.ocf.berkeley.edu, wildfire.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************diff for anthrax.ocf.berkeley.edu, autocrat.ocf.berkeley.edu, biohazard.ocf.berkeley.edu, coup.ocf.berkeley.edu, deadlock.ocf.berkeley.edu, dementors.ocf.berkeley.edu, fire.ocf.berkeley.edu, firestorm.ocf.berkeley.edu, flood.ocf.berkeley.edu, fraud.ocf.berkeley.edu, gridlock.ocf.berkeley.edu, hellfire.ocf.berkeley.edu, lethe.ocf.berkeley.edu, lightning.ocf.berkeley.edu, maelstrom.ocf.berkeley.edu, quarantine.ocf.berkeley.edu, radiation-mgmt.ocf.berkeley.edu, thunder.ocf.berkeley.edu, whiteout.ocf.berkeley.edu, windshear.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
+ Package[linux-image-amd64] =>
parameters =>
"allow_virtual": false,
"ensure": "purged"
*******************************************
+ Package[linux-image-cloud-amd64] =>
parameters =>
"allow_virtual": false
*******************************************diff for bedbugs.ocf.berkeley.edu, corruption.ocf.berkeley.edu, dataloss.ocf.berkeley.edu, fallingrocks.ocf.berkeley.edu, hal.ocf.berkeley.edu, riptide.ocf.berkeley.edu, scurvy.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************diff for reaper.ocf.berkeley.edu, supernova.ocf.berkeley.edu, tsunami.ocf.berkeley.edu*******************************************
+ Package[hardening-runtime] =>
parameters =>
"allow_virtual": false
*******************************************
+ Package[linux-image-amd64] =>
parameters =>
"allow_virtual": false,
"ensure": "purged"
*******************************************
+ Package[linux-image-cloud-amd64] =>
parameters =>
"allow_virtual": false
*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************diff for vampires.ocf.berkeley.edu*******************************************
Sysctl[kernel.unprivileged_userns_clone] =>
parameters =>
ensure =>
+ absent
value =>
- 1
*******************************************Unaffected hosts |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Harden kernel using kernel command line options and sysctl settings
recommended by the Kernel Self Protection Project.
Also install cloud kernel image on VMs which removes some hardware
support. Benefits: slightly faster boot and reduced attack surface.