Pog 149 CVE 2026 46331

ansible/cve-patching/cve-mitigations.yaml

@@ -0,0 +1,12 @@
+---
+- name: Apply CVE Mitigation Scripts
+  hosts: all
+  become: true
+  vars_files:
+    - vars/cve-scripts.yaml
+
+  tasks:
+    - name: Execute specific CVE script by variable input
+      ansible.builtin.script: "{{ cve_remediation_scripts[target_cve].script_path }}"
+      environment: "{{ cve_remediation_scripts[target_cve].environment }}"
+      when: target_cve in cve_remediation_scripts

ansible/cve-patching/hosts

@@ -0,0 +1,5 @@
+[slurm]
+science-shared-compute-standard-0
+science-shared-compute-standard-1
+science-shared-login-0
+science-shared-control-0

ansible/cve-patching/readme.MD

@@ -0,0 +1,47 @@
+# Usage & Prerequisites
+
+## Host Key Pairs
+
+To use the CVE Mitigation scripts you must have copies of the Key Pairs for the OpenStack hosts that are stored in in 1Password in hte UKSRC Ops Team vault.
+
+To retrieve the PRIVATE KEYS :
+```bash
+op read "op://UKSRC Ops Team/uksrc-ral-prod-keypair/private key?ssh-format=openssh" --out-file .ssh/uksrc-ral-prod-keypair
+```
+**IMPORTANT** : Note it is imperative to save the file with the same name as the key pair in 1Password, as our Ansible hosts file uses the `ansible_ssh_private_key_file:` variable.
+
+### Playbook instructions
+
+```bash
+ansible-playbook  -i k8s-hosts.yaml -l ral-preprod ../cve-mitigations.yaml -e "target_cve=CVE-2026-46331"
+```
+
+### Adding new mitigations
+
+1. Create a script under `ansible/cve-patching/scripts`.
+
+`cvs-2026-46331.sh`
+```bash
+modprobe -r act_pedit
+cat > /etc/modprobe.d/blacklist-act-pedit.conf <<'EOF'
+install act_pedit /bin/false
+blacklist act_pedit
+EOF
+```
+
+2. Edit the `vars/cve-scripts.yaml` file and add a new stanza.
+```
+---
+cve_remediation_scripts:
+  CVE-2026-31431:
+    name: "Copy Fail"
+    script_path: "scripts/cve-2026-31431.sh"
+    timeout: 300
+    environment: {}
+  CVE-2026-46331:
+    name: "net/sched: fix pedit partial COW leading to page cache corruption"
+    script_path: "scripts/cve-2026-46331.sh"
+    timeout: 300
+    environment: {}
+```
+

ansible/cve-patching/scripts/cve-2026-31431.sh

@@ -0,0 +1,2 @@
+echo "install algif_aead /bin/false" | tee /etc/modprobe.d/disable-algif-aead.conf
+rmmod algif_aead 2>/dev/null || true

ansible/cve-patching/scripts/cve-2026-46331.sh

@@ -0,0 +1,5 @@
+modprobe -r act_pedit
+cat > /etc/modprobe.d/blacklist-act-pedit.conf <<'EOF'
+install act_pedit /bin/false
+blacklist act_pedit
+EOF

ansible/cve-patching/vars/cve-scripts.yaml

@@ -0,0 +1,13 @@
+---
+# Dictionary mapping CVE numbers to their specific remediation scripts
+cve_remediation_scripts:
+  CVE-2026-31431:
+    name: "Copy Fail"
+    script_path: "scripts/cve-2026-31431.sh"
+    timeout: 300
+    environment: {}
+  CVE-2026-46331:
+    name: "net/sched: fix pedit partial COW leading to page cache corruption"
+    script_path: "scripts/cve-2026-46331.sh"
+    timeout: 300
+    environment: {}

ansible/k8s-hosts.yaml

@@ -0,0 +1,185 @@
+all:
+  vars:
+    ansible_user: ubuntu
+    ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
+
+cam-dev:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-cam-dev-keypair
+  hosts:
+    uksrc-cam-dev-workers-6g6xt-p4rx5:
+      ansible_host: 192.168.100.54
+    uksrc-cam-dev-workers-6g6xt-fmkv5:
+      ansible_host: 192.168.100.57
+    uksrc-cam-dev-workers-6g6xt-ztvbn:
+      ansible_host: 192.168.100.152
+    uksrc-cam-dev-control-plane-h7hkf:
+      ansible_host: 192.168.100.148
+    uksrc-cam-dev-control-plane-fwbrb:
+      ansible_host: 192.168.100.105
+    uksrc-cam-dev-control-plane-wkkqr:
+      ansible_host: 192.168.100.69
+
+cam-preprod:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-cam-preprod-keypair
+  hosts:
+    uksrc-cam-preprod-workers-wfrj2-ddnnz:
+      ansible_host: 192.168.100.245
+    uksrc-cam-preprod-workers-wfrj2-qqdkv:
+      ansible_host: 192.168.100.67
+    uksrc-cam-preprod-workers-wfrj2-gm98d:
+      ansible_host: 192.168.100.101
+    uksrc-cam-preprod-control-plane-zpncr:
+      ansible_host: 192.168.100.252
+    uksrc-cam-preprod-control-plane-m72lh:
+      ansible_host: 192.168.100.154
+    uksrc-cam-preprod-control-plane-zzc7v:
+      ansible_host: 192.168.100.104
+
+cam-prod:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-cam-prod-keypair
+  hosts:
+    uksrc-cam-prod-workers-4x-a100-quarter-m7fc2-clnt6:
+      ansible_host: 192.168.100.128
+    uksrc-cam-prod-workers-4x-a100-quarter-m7fc2-rsjxl:
+      ansible_host: 192.168.100.9
+    uksrc-cam-prod-workers-general-v2-full-8dtxt-ksqqt:
+      ansible_host: 192.168.100.145
+    uksrc-cam-prod-workers-4x-a100-quarter-m7fc2-bkcw6:
+      ansible_host: 192.168.100.123
+    uksrc-cam-prod-workers-g7229-l89dv:
+      ansible_host: 192.168.100.86
+    uksrc-cam-prod-workers-g7229-2ddjx:
+      ansible_host: 192.168.100.68
+    uksrc-cam-prod-workers-4x-a100-quarter-m7fc2-grg7h:
+      ansible_host: 192.168.100.87
+    uksrc-cam-prod-services-rvj7m-rgsg6:
+      ansible_host: 192.168.100.47
+    uksrc-cam-prod-workers-g7229-lhpnh:
+      ansible_host: 192.168.100.200
+    uksrc-cam-prod-services-rvj7m-w8t2k:
+      ansible_host: 192.168.100.177
+    uksrc-cam-prod-control-plane-qc84m:
+      ansible_host: 192.168.100.20
+    uksrc-cam-prod-control-plane-fdvf4:
+      ansible_host: 192.168.100.85
+    uksrc-cam-prod-control-plane-b5b6g:
+      ansible_host: 192.168.100.147
+    uksrc-cam-prod-xrootd:
+      ansible_host: 192.168.100.99
+ral-dev:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-ral-dev-keypair
+  hosts:
+    uksrc-ral-dev-2-workers-wtjdd-pxknz:
+      ansible_host: 192.168.64.151
+    uksrc-ral-dev-2-control-plane-spz7c:
+      ansible_host: 192.168.65.70
+    uksrc-ral-dev-2-control-plane-kjmbs:
+      ansible_host: 192.168.67.55
+    uksrc-ral-dev-2-workers-wtjdd-9h54c:
+      ansible_host: 192.168.64.170
+    uksrc-ral-dev-2-workers-wtjdd-gh4vf:
+      ansible_host: 192.168.67.253
+    uksrc-ral-dev-2-control-plane-62gbx:
+      ansible_host: 192.168.67.99
+    uksrc-ral-dev-control-plane-c24bg:
+      ansible_host: 192.168.67.221
+    uksrc-ral-dev-control-plane-pthg7:
+      ansible_host: 192.168.64.63
+    uksrc-ral-dev-control-plane-nbpsk:
+      ansible_host: 192.168.67.203
+    uksrc-ral-dev-workers-fn49v-f2f27:
+      ansible_host: 192.168.64.138
+    uksrc-ral-dev-workers-fn49v-ps9nx:
+      ansible_host: 192.168.67.10
+    uksrc-ral-dev-workers-fn49v-n42kb:
+      ansible_host: 192.168.64.25
+
+ral-preprod:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-ral-preprod-keypair
+  hosts:
+    uksrc-ral-preprod-workers-4s5kh-4frgz:
+      ansible_host: 192.168.64.82
+    uksrc-ral-preprod-workers-4s5kh-d6fsr:
+      ansible_host: 192.168.65.150
+    uksrc-ral-preprod-workers-4s5kh-wzprg:
+      ansible_host: 192.168.65.46
+    uksrc-ral-preprod-workers-4s5kh-kb4l8:
+      ansible_host: 192.168.65.233
+    uksrc-ral-preprod-workers-4s5kh-zz89g:
+      ansible_host: 192.168.65.138
+    uksrc-ral-preprod-workers-4s5kh-cv9lc:
+      ansible_host: 192.168.64.144
+    uksrc-ral-preprod-control-plane-8gdsn:
+      ansible_host: 192.168.65.99
+    uksrc-ral-preprod-control-plane-c5w94:
+      ansible_host: 192.168.66.100
+    uksrc-ral-preprod-control-plane-5962t:
+      ansible_host: 192.168.65.149
+
+ral-prod:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-ral-prod-keypair
+  hosts:
+    uksrc-ral-prod-workers-l6c-32-qqlwf-tjf5j:
+      ansible_host: 192.168.66.219
+    uksrc-ral-prod-workers-l6c-32-qqlwf-mn9gs:
+      ansible_host: 192.168.65.107
+    uksrc-ral-prod-workers-l6c-32-qqlwf-kfk8r:
+      ansible_host: 192.168.64.78
+    uksrc-ral-prod-workers-small-nbbx9-qm4dz:
+      ansible_host: 192.168.65.24
+    uksrc-ral-prod-workers-l6c-32-qqlwf-w2kx4:
+      ansible_host: 192.168.67.71
+    uksrc-ral-prod-workers-small-nbbx9-x2zmc:
+      ansible_host: 192.168.67.169
+    uksrc-ral-prod-workers-l6c-32-qqlwf-vjbpk:
+      ansible_host: 192.168.65.94
+    uksrc-ral-prod-workers-small-nbbx9-shpv2:
+      ansible_host: 192.168.64.136
+    uksrc-ral-prod-workers-l6c-32-qqlwf-jjqtn:
+      ansible_host: 192.168.66.116
+    uksrc-ral-prod-workers-small-nbbx9-xkjjd:
+      ansible_host: 192.168.66.98
+    uksrc-ral-prod-workers-l6c-32-qqlwf-6pss6:
+      ansible_host: 192.168.65.36
+    uksrc-ral-prod-workers-small-nbbx9-tgbbz:
+      ansible_host: 192.168.67.153
+    uksrc-ral-prod-workers-l6-c252-xttwf-9dtfw:
+      ansible_host: 192.168.67.245
+    uksrc-ral-prod-workers-small-nbbx9-shdcf:
+      ansible_host: 192.168.67.187
+    uksrc-ral-prod-workers-small-nbbx9-dlpnn:
+      ansible_host: 192.168.64.48
+    uksrc-ral-prod-workers-l6c-32-qqlwf-dk6rd:
+      ansible_host: 192.168.64.201
+    uksrc-ral-prod-workers-small-nbbx9-j8v98:
+      ansible_host: 192.168.64.204
+    uksrc-ral-prod-control-plane-z4sfg:
+      ansible_host: 192.168.64.194
+    uksrc-ral-prod-control-plane-b8jzw:
+      ansible_host: 192.168.67.176
+    uksrc-ral-prod-control-plane-tx6v4:
+      ansible_host: 192.168.65.31
+
+infra-cluster:
+  vars:
+    ansible_ssh_private_key_file: ~/.ssh/uksrc-infra-cluster-keypair
+  hosts:
+    uksrc-infra-cluster-workers-micro-zkht6-zzh7z:
+      ansible_host: 192.168.66.48
+    uksrc-infra-cluster-control-plane-6zcc2:
+      ansible_host: 192.168.65.61
+    uksrc-infra-cluster-workers-micro-zkht6-j2p6k:
+      ansible_host: 192.168.66.226
+    uksrc-infra-cluster-control-plane-xn64s:
+      ansible_host: 192.168.67.7
+    uksrc-infra-cluster-workers-micro-zkht6-jjjhp:
+      ansible_host: 192.168.64.176
+    uksrc-infra-cluster-control-plane-vz6nd:
+      ansible_host: 192.168.66.13
+

ansible/slurm-hosts.yaml

@@ -0,0 +1,46 @@
+all:
+  vars:
+    ansible_user: rocky
+
+slurm-prod:
+  hosts:
+    login-0:
+      ansible_host: 10.8.2.176
+    standard-0:
+      ansible_host: 10.8.3.78
+    a100-0:
+      ansible_host: 10.8.3.147
+    standard-2:
+      ansible_host: 10.8.2.211
+    standard-1:
+      ansible_host: 10.8.0.133
+    control:
+      ansible_host: 10.8.2.194
+    squid-0:
+      ansible_host: 10.8.1.16
+
+slurm-staging:
+  hosts:
+    stg-login-0:
+      ansible_host: 10.8.1.225
+    stg-standard-0:
+      ansible_host: 10.8.3.21
+    stg-standard-1:
+      ansible_host: 10.8.3.145
+    stg-control:
+      ansible_host: 10.8.3.30
+    jumphost:
+      ansible_host: 10.8.3.135
+
+slurm-steveb:
+  hosts:
+    steveb-control:
+      ansible_host: 10.8.0.112
+    steveb-standard-1:
+      ansible_host: 10.8.2.38
+    steveb-standard-0:
+      ansible_host: 10.8.3.141
+    steveb-login-0:
+      ansible_host: 10.8.1.227
+
+