OpenShift must disable virtual syscalls.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-257549 | CNTR-OS-000570 | SV-257549r961149_rule | CCI-001090 | medium |
| Description | ||||
| Virtual syscalls are a mechanism that allows user-space programs to make privileged system calls without transitioning to kernel mode. However, this feature can introduce additional security risks. Disabling virtual syscalls helps to mitigate potential vulnerabilities associated with this mechanism. By reducing the attack surface and limiting the ways in which user-space programs can interact with the kernel, OpenShift can enhance the overall security posture of the platform. | ||||
| STIG | Date | |||
| Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide | 2025-05-15 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
SC-4
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.13.4
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-001090
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-257549r961149_chk)
Check the current CoreOS boot loader configuration has virtual syscalls disabled by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; grep vsyscall=none boot/loader/entries/*.conf || echo "not found"' 2>/dev/null; done
If "vsyscall" is not set to "none" or returns "not found", this is a finding.
Fix Text (F-61208r921589_fix)
Apply the machine config to disable virtual syscalls by executing the following:
for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 05-kernelarg-vsyscall-none-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
kernelArguments:
- vsyscall=none
" | oc apply -f -
done