Just out of curiosity, is adding nousb to the grub command line actually
feasible for enforcement?
I can't remember the last time I used a system where I didn't need a USB
keyboard at some point (can you even buy server class systems with PS/2
support any more?)
Trevor
On Wed, Apr 16, 2014 at 8:23 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 4/16/14, 5:08 PM, Kayse, Josh wrote:
On Apr 16, 2014, at 8:06 PM, Kayse, Josh <Joshua.Kayse(a)gtri.gatech.edu>
wrote:
On Apr 16, 2014, at 7:59 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 4/16/14, 5:44 AM, Jan Lieskovsky wrote:
Patch summary:
* check for 'nousb' argument on kernel command line in /etc/grub.conf
within the bootloader_nousb_argument check in a case-insensitive way
* update comments where appropriate
* add test attestation timestamp
* replace path + filename ind construct with filepath one
Testing report:
* Tested on RHEL-6. Works fine.
I wasn't sure if nousb was case insensitive, so I checked
https://www.kernel.org/doc/Documentation/kernel-parameters.txt
And found this:
Note that ALL kernel parameters listed below are CASE SENSITIVE, and that
a trailing = on the name of any parameter states that that parameter will
be entered as an environment variable, whereas its absence indicates that
it will appear as a kernel argument readable via /proc/cmdline by programs
running once the system is up.
"nousb" was in the list as case sensitive.
Applied your patch (RHEL 6.5), added "nOuSB," and things seem to check
out. Should we follow the kernel docs (which say case sensitive), or allow
insensitivity since it actually works?
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
I’d like to point out that the selinux parameter is also within that list.
I vote we should follow what actually works and assume the kernel docs are
out of date.
-josh
Also, according to
https://github.com/torvalds/linux/blame/master/Documentation/kernel-param... that
line was last changed 2005. Perhaps someone should brave lkml and submit a
patch.
-josh
Thanks for that link!
Ack to Jan's patch.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --