andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CVE-2021-33909 mitigations (#466)

Browse Source 
* Add CVE-2021-33909 mitigations

kernel.unprivileged_bpf_disabled: 1
kernel.unprivileged_userns_clone: 0

The first one is also used by Tails.

Signed-off-by: Paweł Krawczyk <[email protected]>

* Clean up whitespaces

Signed-off-by: Paweł Krawczyk <[email protected]>
This commit is contained in:
Paweł Krawczyk authored and GitHub committed 2021-07-22 16:32:41 +02:00
1 parent 327b1a84c8
commit 66bd1f0aec
1 file changed
+8
Download Patch File Download Diff File Expand all files Collapse all files
roles/os_hardening/defaults/main.yml
+8
View File
@@ -282,6 +282,14 @@ sysctl_config:
vm.mmap_rnd_bits: 32 vm.mmap_rnd_bits: 32
vm.mmap_rnd_compat_bits: 16 vm.mmap_rnd_compat_bits: 16
# Disable unprivileged users from loading eBPF programs into the kernel.
# One of mitigations against CVE-2021-33909. | Tail-2
kernel.unprivileged_bpf_disabled: 1
# Reduce attack surface by disabling unprivileged user namespaces.
# Mitigates CVE-2021-33909 and other exploits.
kernel.unprivileged_userns_clone: 0
# Do not delete the following line or otherwise the playbook will fail # Do not delete the following line or otherwise the playbook will fail
# at task 'create a combined sysctl-dict if overwrites are defined' # at task 'create a combined sysctl-dict if overwrites are defined'
sysctl_overwrite: sysctl_overwrite: