On 9/3/13 12:03 PM, David Smith wrote:
---
RHEL6/input/system/permissions/execution.xml | 11 +++++++++++
1 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/permissions/execution.xml
b/RHEL6/input/system/permissions/execution.xml
index 86d2ea7..081832a 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -199,4 +199,15 @@ allow users to turn the feature on or off at
will.</rationale>
</Rule>
</Group> <!--<Group id="enable_nx"> -->
+
+<Rule id="enable_dmesg_restriction">
+<title>Restrict Access to Kernel Message Buffer</title>
+<description><sysctl-desc-macro sysctl="kernel.dmesg_restrict"
value="1" /></description>
+<ocil><sysctl-check-macro sysctl="kernel.dmesg_restrict"
value="1" /></ocil>
+<rationale>Unprivileged access to the kernel syslog can expose sensitive kernel
+address information.</rationale>
+<ident cce="27366-4" />
+</Rule>
+
+
</Group> <!--<Group id="restrictions"> -->
Should the
new rule be put into a profile?