MEDIUM RHCOS (Node) M2: Kernel Hardening (Sysctl) P3

PASS (vanilla RHCOS 9.8+) Scanned: 2026-08-12 Synced: 2026-06-30

All 4 sysctl settings (randomize_va_space, unprivileged_bpf_disabled, bpf_jit_harden, yama.ptrace_scope) are set to desired values by default in RHCOS 10.2 (OCP 5.0). No MachineConfig needed. telco-reference PR #822 was reverted (PR #837). OCP 4.22 and earlier still require remediation.

No remediation needed on RHCOS 10.2+ (OCP 5.0+). All four sysctl settings are already set to the desired values by default in RHCOS 10.2. The telco-reference PR #822 was reverted (PR #837) since these defaults eliminate the need for MachineConfig remediation. OCP 4.22 and earlier still require remediation.

Overview

This remediation applies kernel security hardening via sysctl parameters. These settings improve memory protection and restrict potentially dangerous kernel features.

Settings

Setting	Value	Description
`kernel.randomize_va_space`	`2`	Full ASLR - randomizes memory layout
`kernel.unprivileged_bpf_disabled`	`1`	Prevent BPF-based privilege escalation
`kernel.yama.ptrace_scope`	`1`	Restrict ptrace to parent-child processes
`net.core.bpf_jit_harden`	`2`	Harden BPF JIT against spraying attacks

Implementation

The remediation applies a MachineConfig with sysctl settings:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-sysctl-medium
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/sysctl.d/75-security-hardening.conf
          mode: 0644
          overwrite: true
          contents:
            inline: |
              # Memory protection
              kernel.randomize_va_space = 2

              # BPF security
              kernel.unprivileged_bpf_disabled = 1
              net.core.bpf_jit_harden = 2

              # Process tracing restriction
              kernel.yama.ptrace_scope = 1

Compliance Checks Remediated

This group addresses 4 compliance checks:

Check	Profile	Description	Docs
`rhcos4-e8-worker-sysctl-kernel-randomize-va-space`	E8	Enable ASLR	📖
`rhcos4-e8-worker-sysctl-kernel-unprivileged-bpf-disabled`	E8	Disable unprivileged BPF	📖
`rhcos4-e8-worker-sysctl-kernel-yama-ptrace-scope`	E8	Restrict ptrace	📖
`rhcos4-e8-worker-sysctl-net-core-bpf-jit-harden`	E8	Harden BPF JIT	📖

Source Remediation Files

medium/rhcos4-e8-worker-sysctl-kernel-randomize-va-space.yaml
medium/rhcos4-e8-worker-sysctl-kernel-unprivileged-bpf-disabled.yaml
medium/rhcos4-e8-worker-sysctl-kernel-yama-ptrace-scope.yaml
medium/rhcos4-e8-worker-sysctl-net-core-bpf-jit-harden.yaml

Verification

After applying, verify sysctl settings:

oc debug node/<node-name> -- chroot /host sysctl kernel.randomize_va_space kernel.unprivileged_bpf_disabled
# Expected:
# kernel.randomize_va_space = 2
# kernel.unprivileged_bpf_disabled = 1

Security Impact

ASLR (kernel.randomize_va_space=2): Makes memory-based exploits significantly harder
BPF restrictions: Prevents unprivileged users from using eBPF for privilege escalation
Ptrace scope: Limits debugging capabilities to parent-child process relationships

← M1 All Groups M3 →