documentation_complete: true


title: 'Disable Access to Network bpf() Syscall From Unprivileged Processes'

description: '{{{ describe_sysctl_option_value(sysctl="kernel.unprivileged_bpf_disabled", value="1") }}}'

rationale: |-
    Loading and accessing the packet filters programs and maps using the bpf()
    syscall has the potential of revealing sensitive information about the kernel state.

severity: medium

identifiers:
    cce@rhcos4: CCE-82504-2
    cce@rhel8: CCE-82974-7
    cce@rhel9: CCE-83957-1
    cce@rhel10: CCE-89405-5

references:
    nist: AC-6,SC-7(10)
    srg: SRG-OS-000132-GPOS-00067,SRG-OS-000480-GPOS-00227
    stigid@ol8: OL08-00-040281

{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.unprivileged_bpf_disabled", value="1") }}}

fixtext: |-
    Configure {{{ full_name }}} to prevent privilege escalation thru the kernel by disabling access to the bpf syscall.

srg_requirement: '{{{ full_name }}} must disable access to network bpf syscall from unprivileged processes.'

platform: system_with_kernel

template:
    name: sysctl
    vars:
        sysctlvar: kernel.unprivileged_bpf_disabled
        sysctlval: '1'
        datatype: int
