Skip to content

fix(azurelinux-release): persist CIS sysctl defaults - #18633

Open
Lynsey Rydberg (corvus-callidus) wants to merge 1 commit into
4.0from
lyrydber/cis-sysctl-runtime-hardening
Open

fix(azurelinux-release): persist CIS sysctl defaults#18633
Lynsey Rydberg (corvus-callidus) wants to merge 1 commit into
4.0from
lyrydber/cis-sysctl-runtime-hardening

Conversation

@corvus-callidus

@corvus-callidus Lynsey Rydberg (corvus-callidus) commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Summary

Persist CIS network sysctl settings in 70-azurelinux-hardening.conf:

  • net.ipv4.conf.all.secure_redirects = 0
  • net.ipv4.conf.default.secure_redirects = 0
  • net.ipv6.conf.all.accept_ra = 0
  • net.ipv6.conf.default.accept_ra = 0

Resolves:

  • AB#22889 — Ensure net.ipv4.conf.all.secure_redirects is configured
  • AB#22890 — Ensure net.ipv4.conf.default.secure_redirects is configured
  • AB#22901 — Ensure net.ipv6.conf.all.accept_ra is configured
  • AB#22902 — Ensure net.ipv6.conf.default.accept_ra is configured

Testing

Built azurelinux-release, installed on an AZL4 VM, applied the sysctl policy, and ran CIS-CAT Level 1 Server. All four controls pass.

Set the secure redirect and router advertisement controls to 0 in the common hardening policy so they are applied at boot and explicitly satisfy the CIS requirements.
Copilot AI balanced review requested due to automatic review settings August 26, 2026 20:37

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Persists four CIS network sysctl defaults in azurelinux-release.

Changes:

  • Disables secure redirects and IPv6 router advertisements.
  • Bumps package release to 28.
  • Refreshes rendered files and component lock.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
File Description
base/comps/azurelinux-release/70-azurelinux-hardening.conf Adds persistent CIS sysctl defaults.
base/comps/azurelinux-release/azurelinux-release.spec Bumps release and changelog.
specs/a/azurelinux-release/70-azurelinux-hardening.conf Updates rendered sysctl configuration.
specs/a/azurelinux-release/azurelinux-release.spec Updates rendered package metadata.
locks/azurelinux-release.lock Refreshes the input fingerprint.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@tobiasb-ms

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants