--- /dev/null   2018-09-24 12:07:02.352998857 +0200

+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict.rule      2018-08-20 22:58:34.441789550 +0200

@@ -0,0 +1,19 @@

+documentation_complete: true

+

+title: 'Restrict exposed kernel pointers addresses access'

+

+description: '{{{ describe_sysctl_option_value(sysctl="kernel.kptr_restrict", value="1") }}}'

+

+rationale: |-

+    Exposing kernel pointers (through procfs or <tt>seq_printf()</tt>) exposes

+    kernel writeable structures that can contain functions pointers. If a write vulnereability occurs

+    in the kernel allowing a write access to any of this structure, the kernel can be compromise. This

+    option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses,

+    replacing them with 0.

+

+severity: low

+

+references:

+    anssi: NT28(R23)

+

+{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.kptr_restrict", value="1") }}}