fix(azurelinux-release): deny network modules for CIS - #18560
Merged
Christopher Co (christopherco) merged 1 commit intoAug 26, 2026
Conversation
Lynsey Rydberg (corvus-callidus)
requested a review
from a team
as a code owner
August 24, 2026 04:49
Copilot started reviewing on behalf of
Lynsey Rydberg (corvus-callidus)
August 24, 2026 04:50
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Adds default CIS hardening to block unused ATM, CAN, TIPC, and SCTP kernel modules.
Changes:
- Adds and packages a modprobe denylist.
- Bumps
azurelinux-releaseto release 27. - Refreshes generated output and component lock.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
base/comps/azurelinux-release/azurelinux-release.spec |
Packages the policy and bumps release. |
base/comps/azurelinux-release/60-azurelinux-cis-module-denylist.conf |
Defines module restrictions. |
specs/a/azurelinux-release/azurelinux-release.spec |
Rendered package specification. |
specs/a/azurelinux-release/60-azurelinux-cis-module-denylist.conf |
Rendered policy file. |
locks/azurelinux-release.lock |
Refreshes the component fingerprint. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Lynsey Rydberg (corvus-callidus)
force-pushed
the
lyrydber/cis-network-module-denylist
branch
from
August 24, 2026 17:19
3dabdb2 to
97c3df6
Compare
Copilot started reviewing on behalf of
Lynsey Rydberg (corvus-callidus)
August 24, 2026 17:19
View session
Contributor
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Lynsey Rydberg (corvus-callidus)
force-pushed
the
lyrydber/cis-network-module-denylist
branch
from
August 25, 2026 18:28
97c3df6 to
1795a46
Compare
Contributor
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Christopher Co (christopherco)
requested changes
Aug 25, 2026
Christopher Co (christopherco)
left a comment
Christopher Co (christopherco)
left a comment
Collaborator
There was a problem hiding this comment.
One question. Rest looks good.
| @@ -0,0 +1,14 @@ | |||
| # Deny unused network protocol modules by default. Administrators can override | |||
| # this policy in a later modprobe.d configuration file when a protocol is needed. | |||
Collaborator
There was a problem hiding this comment.
question (blocking): Can a later modprobe.d configuration undo this denylist?
I think kmod uses the first matching install directive , and blacklist entries accumulate, so a later file cannot undo this policy. An administrator can override if they supply /etc/modprobe.d/60-azurelinux-cis-module-denylist.conf so that it shadows this file entirely.
Contributor
Author
There was a problem hiding this comment.
Revised the comment to correct the override instructions.
Install an explicit modprobe policy for the unused ATM, CAN, TIPC, and SCTP network protocol modules. The vendor policy prevents automatic loading by default while allowing administrators to override it with a same-named file in /etc/modprobe.d.
Lynsey Rydberg (corvus-callidus)
force-pushed
the
lyrydber/cis-network-module-denylist
branch
from
August 26, 2026 16:59
1795a46 to
de43252
Compare
Copilot started reviewing on behalf of
Lynsey Rydberg (corvus-callidus)
August 26, 2026 16:59
View session
Contributor
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Lynsey Rydberg (corvus-callidus)
requested a review
from Christopher Co (christopherco)
August 26, 2026 17:31
Christopher Co (christopherco)
approved these changes
Aug 26, 2026
Christopher Co (christopherco)
deleted the
lyrydber/cis-network-module-denylist
branch
August 26, 2026 19:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a customer-overridable modprobe policy that prevents loading the unused ATM, CAN, TIPC, and SCTP network protocol modules.
Validation
Built and installed on a clean AZL4 Marketplace VM. All four relevant CIS-CAT rules pass.
Addresses AB#22877, AB#22878, AB#22879, AB#22880