-
Notifications
You must be signed in to change notification settings - Fork 464
/
kspp.go
93 lines (80 loc) · 2.23 KB
/
kspp.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
package kspp
import (
"fmt"
"github.com/hashicorp/go-multierror"
"github.com/talos-systems/go-procfs/procfs"
"github.com/talos-systems/talos/pkg/sysctl"
)
// RequiredKSPPKernelParameters is the set of kernel parameters required to
// satisfy the KSPP.
var RequiredKSPPKernelParameters = procfs.Parameters{
procfs.NewParameter("page_poison").Append("1"),
procfs.NewParameter("slab_nomerge").Append(""),
procfs.NewParameter("slub_debug").Append("P"),
procfs.NewParameter("pti").Append("on"),
}
// EnforceKSPPKernelParameters verifies that all required KSPP kernel
// parameters are present with the right value.
func EnforceKSPPKernelParameters() error {
var result *multierror.Error
for _, values := range RequiredKSPPKernelParameters {
var val *string
if val = procfs.ProcCmdline().Get(values.Key()).First(); val == nil {
result = multierror.Append(result, fmt.Errorf("KSPP kernel parameter %s is required", values.Key()))
continue
}
expected := values.First()
if *val != *expected {
result = multierror.Append(result, fmt.Errorf("KSPP kernel parameter %s was found with value %s, expected %s", values.Key(), *val, *expected))
}
}
return result.ErrorOrNil()
}
// EnforceKSPPSysctls verifies that all required KSPP kernel sysctls are set
// with the right value.
func EnforceKSPPSysctls() (err error) {
props := []*sysctl.SystemProperty{
{
Key: "kernel.kptr_restrict",
Value: "1",
},
{
Key: "kernel.dmesg_restrict",
Value: "1",
},
{
Key: "kernel.perf_event_paranoid",
Value: "3",
},
// We can skip this sysctl because CONFIG_KEXEC is not set.
// {
// Key: "kernel.kexec_load_disabled",
// Value: "1",
// },
{
Key: "kernel.yama.ptrace_scope",
Value: "1",
},
{
Key: "user.max_user_namespaces",
Value: "0",
},
{
Key: "kernel.unprivileged_bpf_disabled",
Value: "1",
},
{
Key: "net.core.bpf_jit_harden",
Value: "2",
},
}
for _, prop := range props {
if err = sysctl.WriteSystemProperty(prop); err != nil {
return
}
}
return nil
}