HighOS hardeningBLWK-KERNEL-006

Unprivileged users can load BPF programs into the kernel

What this means

kernel.unprivileged_bpf_disabled is 0 — any local user can load BPF programs into the kernel without CAP_SYS_ADMIN. The BPF verifier has been the source of numerous local privilege-escalation CVEs; this setting is what determines whether that class of bug is reachable by an unprivileged attacker at all.

How to fix it

Set kernel.unprivileged_bpf_disabled=1 via /etc/sysctl.d/ and run sysctl --system.

Check it yourself

Run a scan and look for BLWK-KERNEL-006 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sysctl_kernel and reports this check when:

unprivileged_bpf_disabled == 0

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.5.2
• MITRE ATT&CK T1068

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001