Adjust net.ipv4.conf.all.rp_filter for CNI compatibility

Sets net.ipv4.conf.all.rp_filter=0 during CIS hardening to ensure CNIs don't break when `sysctl -p` is run at any point later on (such as Stylus Agent upgrades)
spectrocloud · Aug 19, 2024 · 8993987 · 8993987
1 parent d2be48f
commit 8993987
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/cis-harden/harden.sh b/cis-harden/harden.sh
@@ -174,8 +174,11 @@ harden_sysctl() {
 
 	update_config_files 'net.ipv4.icmp_echo_ignore_broadcasts' 'net.ipv4.icmp_echo_ignore_broadcasts=1' ${config_file}
 	update_config_files 'net.ipv4.icmp_ignore_bogus_error_responses' 'net.ipv4.icmp_ignore_bogus_error_responses=1' ${config_file}
-	update_config_files 'net.ipv4.conf.all.rp_filter' 'net.ipv4.conf.all.rp_filter=1' ${config_file}
-	update_config_files 'net.ipv4.conf.default.rp_filter' 'net.ipv4.conf.default.rp_filter=1' ${config_file}
+
+        # CIS hardening requires "net.ipv4.conf.all.rp_filter=1" but this is incompatible with CNIs, hence we set this to 0 instead
+        update_config_files 'net.ipv4.conf.all.rp_filter' 'net.ipv4.conf.all.rp_filter=0' ${config_file}
+
+        update_config_files 'net.ipv4.conf.default.rp_filter' 'net.ipv4.conf.default.rp_filter=1' ${config_file}
 	update_config_files 'net.ipv4.tcp_syncookies' 'net.ipv4.tcp_syncookies=1' ${config_file}
 	update_config_files 'kernel.randomize_va_space' 'kernel.randomize_va_space=2' ${config_file}
 	update_config_files 'fs.suid_dumpable' 'fs.suid_dumpable=0' ${config_file}
@@ -930,4 +933,4 @@ cleanup_cache
 
 mv /etc/os-release.bak /etc/os-release
 
-exit 0
+exit 0