Bug 2081728

Description of problem:

There are two SCAP rules in the OSPP SCAP profile that deal with BPF:

- sysctl_kernel_unprivileged_bpf_disabled which sets the kernel.unprivileged_bpf_disabled value to 1.

  However, on RHEL 9 the kernel supports new value 2 which per https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html#unprivileged-bpf-disabled makes it for a privileged admin to re-enable unprivileged BPF. The value 2 is also the RHEL 9 default. So the current sysctl_kernel_unprivileged_bpf_disabled rule unnecessarily modifies the RHEL 9 default.

  Therefore, we'd like the sysctl_kernel_unprivileged_bpf_disabled rule to accept any non-zero value (1, 2).

- sysctl_net_core_bpf_jit_harden which sets the net.core.bpf_jit_harden value to 2

  Contrary to the information about the values on https://www.kernel.org/doc/html/latest/admin-guide/sysctl/net.html#bpf-jit-harden (0 = disable JIT hardening, 1 = enable JIT hardening for unprivileged users only, 2 = enable JIT hardening for all users), Jiří Benc clarified that bpf_jit_harden=1 disables kallsyms access from bpf programs and all users, and it turns on constants blinding by using random value + XOR for CAP_BPF; so the only thing in which value 1 and 2 differ is the constants blinding for CAP_SYS_ADMIN processes in the initial user namespaces. The extra constants blinding with bpf_jit_harden=2 does not really help with CVE mitigation.

  Therefore, we'd like this rule to be removed from the RHEL 9 OSPP profile.

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.60-6.el9_0

How reproducible:

Deterministic.

Steps to Reproduce:
1. cat /proc/sys/kernel/unprivileged_bpf_disabled
2. cat /proc/sys/net/core/bpf_jit_harden
3. Run
   oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
   and check for any of the rules above.
4. cat /proc/sys/kernel/unprivileged_bpf_disabled
5. cat /proc/sys/net/core/bpf_jit_harden

Actual results:

1. 2
2. 1
3. The rules sysctl_kernel_unprivileged_bpf_disabled and sysctl_net_core_bpf_jit_harden are listed.
4. 1
5. 2

Expected results:

1. 2
2. 1
3. Only rule sysctl_kernel_unprivileged_bpf_disabled is listed.
4. 2
5. 1

Additional info: