RHEL 9 must disable access to network bpf system call from nonprivileged processes.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-257810	SRG-OS-000132-GPOS-00067	RHEL-09-213075	SV-257810r1044869_rule	2025-02-27	2

Description
Loading and accessing the packet filters programs and maps using the bpf() system call has the potential of revealing sensitive information about the kernel state. Satisfies: SRG-OS-000132-GPOS-00067, SRG-OS-000480-GPOS-00227

ℹ️ Check
Verify that RHEL 9 prevents privilege escalation through the kernel by disabling access to the bpf system call with the following commands: $ sysctl kernel.unprivileged_bpf_disabled kernel.unprivileged_bpf_disabled = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding. Check that the configuration files are present to enable this kernel parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config \| egrep -v '^(#\|;)' \| grep -F kernel.unprivileged_bpf_disabled \| tail -1 kernel.unprivileged_bpf_disabled = 1 If the network parameter "kernel.unprivileged_bpf_disabled" is not equal to "1", or nothing is returned, this is a finding.

ℹ️ Check

Verify that RHEL 9 prevents privilege escalation through the kernel by disabling access to the bpf system call with the following commands: $ sysctl kernel.unprivileged_bpf_disabled kernel.unprivileged_bpf_disabled = 1 If the returned line does not have a value of "1", or a line is not returned, this is a finding. Check that the configuration files are present to enable this kernel parameter. $ sudo /usr/lib/systemd/systemd-sysctl --cat-config | egrep -v '^(#|;)' | grep -F kernel.unprivileged_bpf_disabled | tail -1 kernel.unprivileged_bpf_disabled = 1 If the network parameter "kernel.unprivileged_bpf_disabled" is not equal to "1", or nothing is returned, this is a finding.

✔️ Fix
Configure the currently loaded kernel parameter to the secure setting: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1 Configure RHEL 9 to prevent privilege escalation through the kernel by disabling access to the bpf syscall by adding the following line to a file in the "/etc/sysctl.d" directory: kernel.unprivileged_bpf_disabled = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl --system

✔️ Fix

Configure the currently loaded kernel parameter to the secure setting: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1 Configure RHEL 9 to prevent privilege escalation through the kernel by disabling access to the bpf syscall by adding the following line to a file in the "/etc/sysctl.d" directory: kernel.unprivileged_bpf_disabled = 1 The system configuration files must be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sysctl --system