From 66bd1f0aec0b7532618b1dbe012efc6992556b52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Krawczyk?=
 <616047+kravietz@users.noreply.github.com>
Date: Thu, 22 Jul 2021 14:32:41 +0000
Subject: [PATCH] Add CVE-2021-33909 mitigations (#466)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add CVE-2021-33909 mitigations

kernel.unprivileged_bpf_disabled: 1
kernel.unprivileged_userns_clone: 0

The first one is also used by Tails.

Signed-off-by: Paweł Krawczyk <616047+kravietz@users.noreply.github.com>

* Clean up whitespaces

Signed-off-by: Paweł Krawczyk <616047+kravietz@users.noreply.github.com>
---
 roles/os_hardening/defaults/main.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/roles/os_hardening/defaults/main.yml b/roles/os_hardening/defaults/main.yml
index 95906dd6..01f71cec 100644
--- a/roles/os_hardening/defaults/main.yml
+++ b/roles/os_hardening/defaults/main.yml
@@ -282,6 +282,14 @@ sysctl_config:
   vm.mmap_rnd_bits: 32
   vm.mmap_rnd_compat_bits: 16
 
+  # Disable unprivileged users from loading eBPF programs into the kernel.
+  # One of mitigations against CVE-2021-33909. | Tail-2
+  kernel.unprivileged_bpf_disabled: 1
+
+  # Reduce attack surface by disabling unprivileged user namespaces.
+  # Mitigates CVE-2021-33909 and other exploits.
+  kernel.unprivileged_userns_clone: 0
+
 # Do not delete the following line or otherwise the playbook will fail
 # at task 'create a combined sysctl-dict if overwrites are defined'
 sysctl_overwrite: