diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled.rule b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled.rule new file mode 100644 index 0000000000..a8fc8715e1 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled.rule @@ -0,0 +1,17 @@ +documentation_complete: true + +prodtype: rhel6,rhel7,fedora + +title: 'Disable kernel image loading' + +description: '{{{ describe_sysctl_option_value(sysctl="kernel.kexec_load_disabled", value="1") }}}' + +rationale: | + Disabling kexec_load allows greater control of the kernel memory. + It makes it impossible to load another kernel image after it has been disabled. + +severity: unknown + + +{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.kexec_load_disabled", value="1") }}} + diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope.rule b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope.rule new file mode 100644 index 0000000000..67b7ff8056 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope.rule @@ -0,0 +1,19 @@ +documentation_complete: true + +prodtype: rhel6,rhel7,fedora + +title: 'Restrict usage of ptrace to descendant processes' + +description: '{{{ describe_sysctl_option_value(sysctl="kernel.yama.ptrace_scope", value="1") }}}' + +rationale: | + Unrestricted usage of ptrace allows compromised binaries to run ptrace + on another processes of the user. Like this, the attacker can steal + sensitive information from the target processes (e.g. SSH sessions, web browser, ...) + without any additional assistance from the user (i.e. without resorting to phishing). + +severity: unknown + + +{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.yama.ptrace_scope", value="1") }}} + diff --git a/rhel7/profiles/ospp42.profile b/rhel7/profiles/ospp42.profile index 8550434ffa..a29e282b6e 100644 --- a/rhel7/profiles/ospp42.profile +++ b/rhel7/profiles/ospp42.profile @@ -33,6 +33,10 @@ selections: - var_password_pam_lcredit=1 - accounts_password_pam_lcredit - package_screen_installed + - sysctl_kernel_yama_ptrace_scope + - sysctl_kernel_kptr_restrict + - sysctl_kernel_kexec_load_disabled + - sysctl_kernel_dmesg_restrict - dconf_gnome_screensaver_idle_activation_enabled - dconf_gnome_screensaver_idle_delay - dconf_gnome_screensaver_lock_delay diff --git a/rhel7/templates/csv/sysctl_values.csv b/rhel7/templates/csv/sysctl_values.csv index 12f0232760..3090159aa5 100644 --- a/rhel7/templates/csv/sysctl_values.csv +++ b/rhel7/templates/csv/sysctl_values.csv @@ -1,7 +1,10 @@ # Add to generate hard-coded OVAL and remediation content. # Add to generate OVAL and remediation content that use the XCCDF value. fs.suid_dumpable,0 +kernel.yama.ptrace_scope,1 +kernel.kptr_restrict,1 kernel.dmesg_restrict,1 +kernel.kexec_load_disabled,1 #kernel.exec-shield,1 kernel.randomize_va_space,2 net.ipv4.conf.all.accept_redirects, diff --git a/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_dmesg_restrict/disabled.fail.sh b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_dmesg_restrict/disabled.fail.sh new file mode 100644 index 0000000000..715f0b81dc --- /dev/null +++ b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_dmesg_restrict/disabled.fail.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# +# profiles = xccdf_org.ssgproject.content_profile_ospp42 + +. ../sysctl.sh + +sysctl_set_kernel_setting_to dmsg_restrict 0 diff --git a/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_kexec_load_disabled/disabled.fail.sh b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_kexec_load_disabled/disabled.fail.sh new file mode 100644 index 0000000000..05cd772b7f --- /dev/null +++ b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_kexec_load_disabled/disabled.fail.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# +# profiles = xccdf_org.ssgproject.content_profile_ospp42 + +. ../sysctl.sh + +sysctl_set_kernel_setting_to kexec_load_disabled 0 diff --git a/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_kptr_restrict/disabled.fail.sh b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_kptr_restrict/disabled.fail.sh new file mode 100644 index 0000000000..ac7922d927 --- /dev/null +++ b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_kptr_restrict/disabled.fail.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# +# profiles = xccdf_org.ssgproject.content_profile_ospp42 + +. ../sysctl.sh + +sysctl_set_kernel_setting_to kptr_restrict 0 diff --git a/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_yama_ptrace_scope/disabled.fail.sh b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_yama_ptrace_scope/disabled.fail.sh new file mode 100644 index 0000000000..6e0892c4d8 --- /dev/null +++ b/tests/data/group_system/group_permissions/group_restrictions/rule_sysctl_kernel_yama_ptrace_scope/disabled.fail.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# +# profiles = xccdf_org.ssgproject.content_profile_ospp42 + +. ../sysctl.sh + +sysctl_set_kernel_setting_to yama.ptrace_scope 0 diff --git a/tests/data/group_system/group_permissions/group_restrictions/sysctl.sh b/tests/data/group_system/group_permissions/group_restrictions/sysctl.sh new file mode 100644 index 0000000000..6a424a3641 --- /dev/null +++ b/tests/data/group_system/group_permissions/group_restrictions/sysctl.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# Sets the kernel setting using sysctl exec as well as in sysctl config file. +# $1: The setting name without the leading 'kernel.' +# $2: The value to set the setting to +function sysctl_set_kernel_setting_to { + local setting_name="kernel.$1" setting_value="$2" + sysctl -w "$setting_name=$setting_value" + if grep -q "^$setting_name" /etc/sysctl.conf; then + sed -i "s/^$setting_name.*/$setting_name = $setting_value/" /etc/sysctl.conf + else + echo "$setting_name = $setting_value" >> /etc/sysctl.conf + fi +}