From c70dec125aef0b5ffb688a6044ec97dc9cb8947b Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Mon, 27 Jul 2026 18:14:54 +0100 Subject: [PATCH] CMP-4446: Add manual rule kubevirt-disable-intel-txt (CIS OCP-Virt 5.1) --- .../kubevirt-disable-intel-txt/rule.yml | 32 +++++++++++++++++++ .../ocp4/profiles/cis-vm-extension.profile | 1 + 2 files changed, 33 insertions(+) create mode 100644 applications/openshift-virtualization/kubevirt-disable-intel-txt/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-disable-intel-txt/rule.yml b/applications/openshift-virtualization/kubevirt-disable-intel-txt/rule.yml new file mode 100644 index 000000000000..01cfe2d61e01 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-disable-intel-txt/rule.yml @@ -0,0 +1,32 @@ +documentation_complete: true + +title: 'Disable Intel Trusted Execution Technology (TXT)' + +description: |- + Intel Trusted Execution Technology (TXT) should be disabled in the + host BIOS/firmware settings. TXT provides hardware-based memory + protection through a Measured Launch Environment, but it can + conflict with virtualization workloads and introduce compatibility + issues with certain hypervisor configurations. In environments + where TXT is not actively used for measured launch, leaving it + enabled adds unnecessary complexity without a corresponding + security benefit. + +rationale: |- + TXT can interfere with virtualization features and introduce + unexpected behavior during host boot and workload scheduling. + When TXT is not part of the security architecture, disabling it + reduces the attack surface associated with the TXT firmware + interface and avoids potential conflicts with the hypervisor + and virtual machine management stack. + +severity: medium + +ocil_clause: 'Intel TXT is enabled in the host firmware' + +ocil: |- + Run the following command on each cluster node to check the + Intel TXT BIOS setting: + 
$ fwupdmgr get-bios-settings
+ Look for the TxT setting and ensure its current value is + Disabled. diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index 9c3e034f0bb9..74e04e3fc72b 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -40,3 +40,4 @@ selections: - kubevirt-ksm-disabled - kubevirt-no-jsonpatch-annotations - kubevirt-restrict-exec-access-to-pods + - kubevirt-disable-intel-txt