work around with CVE-2019-3874

2019-03-28 09:44:56 +08:00 · 2019-03-28 09:44:56 +08:00 · b684e96b6f
parent b88d352ad7
commit b684e96b6f
2 changed files with 5 additions and 0 deletions
--- a/roles/prepare/files/sctp.conf
+++ b/roles/prepare/files/sctp.conf
@ -0,0 +1,2 @@
+# put sctp into blacklist
+install sctp /bin/true
--- a/roles/prepare/tasks/common.yml
+++ b/roles/prepare/tasks/common.yml
@ -39,3 +39,6 @@

 - name: 设置系统 ulimits
  template: src=30-k8s-ulimits.conf.j2 dest=/etc/security/limits.d/30-k8s-ulimits.conf
+
+- name: 把SCTP列入内核模块黑名单
+  copy: src=sctp.conf dest=/etc/modprobe.d/sctp.conf