MEDIUM RHCOS (Node) M2: Kernel Hardening (Sysctl) P3

Verified Compare Branch Scanned: 2026-01-14

FAIL on vanilla RHCOS 9.8. Remediation tested and works.

Overview

This remediation applies kernel security hardening via sysctl parameters. These settings improve memory protection and restrict potentially dangerous kernel features.

Note: This group is currently On Hold pending further investigation. PR #528 was closed.

Settings

Setting	Value	Description
`kernel.randomize_va_space`	`2`	Full ASLR - randomizes memory layout
`kernel.unprivileged_bpf_disabled`	`1`	Prevent BPF-based privilege escalation
`kernel.yama.ptrace_scope`	`1`	Restrict ptrace to parent-child processes
`net.core.bpf_jit_harden`	`2`	Harden BPF JIT against spraying attacks

Implementation

The remediation applies a MachineConfig with sysctl settings:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-sysctl-medium
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/sysctl.d/75-security-hardening.conf
          mode: 0644
          overwrite: true
          contents:
            inline: |
              # Memory protection
              kernel.randomize_va_space = 2

              # BPF security
              kernel.unprivileged_bpf_disabled = 1
              net.core.bpf_jit_harden = 2

              # Process tracing restriction
              kernel.yama.ptrace_scope = 1

Compliance Checks Remediated

This group addresses 4 compliance checks:

Check	Profile	Description	Docs
`rhcos4-e8-worker-sysctl-kernel-randomize-va-space`	E8	Enable ASLR	📖
`rhcos4-e8-worker-sysctl-kernel-unprivileged-bpf-disabled`	E8	Disable unprivileged BPF	📖
`rhcos4-e8-worker-sysctl-kernel-yama-ptrace-scope`	E8	Restrict ptrace	📖
`rhcos4-e8-worker-sysctl-net-core-bpf-jit-harden`	E8	Harden BPF JIT	📖

Source Remediation Files

medium/rhcos4-e8-worker-sysctl-kernel-randomize-va-space.yaml
medium/rhcos4-e8-worker-sysctl-kernel-unprivileged-bpf-disabled.yaml
medium/rhcos4-e8-worker-sysctl-kernel-yama-ptrace-scope.yaml
medium/rhcos4-e8-worker-sysctl-net-core-bpf-jit-harden.yaml

Verification

After applying, verify sysctl settings:

oc debug node/<node-name> -- chroot /host sysctl kernel.randomize_va_space kernel.unprivileged_bpf_disabled
# Expected:
# kernel.randomize_va_space = 2
# kernel.unprivileged_bpf_disabled = 1

Security Impact

ASLR (kernel.randomize_va_space=2): Makes memory-based exploits significantly harder
BPF restrictions: Prevents unprivileged users from using eBPF for privilege escalation
Ptrace scope: Limits debugging capabilities to parent-child process relationships

Upstream Proposal

The following changes could eliminate the need for MachineConfig remediation. Items are categorized by recommended scope:

net.core.bpf_jit_harden=2 All OCP Low

openshift/os /usr/lib/sysctl.d/50-security-hardening.conf View Proposed Change

Prevents BPF JIT spraying attacks. KSPP recommended. Zero workload impact.
Scope: Negligible performance impact. Protects against JIT spraying on all clusters. KSPP recommended.

kernel.yama.ptrace_scope=1 All OCP Med

Fedora/RHEL (elfutils RPM) Override /usr/lib/sysctl.d/10-default-yama-scope.conf View Proposed Change

Kernel default IS 1 but elfutils RPM overrides to 0. RHCOS is a container host, not a dev workstation. Fedora 44 Change Proposal changed ptrace_scope from 1 to 2.
Scope: Kernel default is already 1. Only relaxed by elfutils RPM meant for developer workstations, not container hosts.

PR History

net.core.bpf_jit_harden=2 Closed redirected

coreos/rhel-coreos-config#264 opened 2026-06-02, closed 2026-06-04

Maintainer (@dustymabe) prefers accepting RHEL defaults. Suggested proposing bpf_jit_harden further upstream at the RHEL/Fedora level. Fedora 44 Change Proposal changed bpf_jit_harden from 0 to 2 by default — may flow to RHEL 10. Hold and verify.

coreos/rhel-coreos-config/pull/264 www.mail-archive.com/devel@lists.fedoraproject.org/msg209291.html

kernel.yama.ptrace_scope=1 Closed redirected