mediumsystemverified ✓rollback-safe
Disable unprivileged BPF
kernel-unprivileged-bpf · RHEL ≥ 8 · 1 impl
Description
The kernel.unprivileged_bpf_disabled sysctl must be set to prevent unprivileged users from loading BPF programs.
Rationale
BPF (Berkeley Packet Filter) programs run in the kernel and could be used for privilege escalation or other attacks. Restricting BPF to privileged users limits this attack surface.
Check → Remediate
Checksysctl_value
- key:
- kernel.unprivileged_bpf_disabled
- expected:
- 1
Remediatesysctl_set
- key:
- kernel.unprivileged_bpf_disabled
- value:
- 1
Framework references
STIG
V-230545V-257810V-281335 / RHEL-10-800030
NIST 800-53
CM-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#sysctl#bpf#kernel#security#stig