On 1/14/13 2:42 AM, Shawn Wells wrote:
0001-bugfix-Fixed-kernel.randomize_va_space-OVAL-check.patch
From e7973bb192b23d1185e5c9f925572f81cd6b0bfe Mon Sep 17 00:00:00 2001 From: Shawn Wellsshawn@redhat.com Date: Mon, 14 Jan 2013 02:35:34 -0500 Subject: [PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check
kernel.randomize_va_space OVAL check should accept values >= 1, as to not fail users who exceed recommended security settings.
Pushing this as a bugfix.
Testing: 2
Prior to OVAL change: Title Enable Randomized Layout of Virtual Address Space Rule enable_randomize_va_space Ident CCE-26999-3 Result fail
After OVAL change: Title Enable Randomized Layout of Virtual Address Space Rule enable_randomize_va_space Ident CCE-26999-3 Result pass
A thank you goes to Kenneth S. for reporting this bug!
.../checks/sysctl_kernel_randomize_va_space.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml index 24dfe55..2633d83 100644 --- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml +++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml @@ -23,6 +23,6 @@ </unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_kernel_randomize_va_space" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
- <unix:value datatype="int" operation="greater than or equal">1</unix:value> </unix:sysctl_state>
</def-group>
-- 1.7.1
Pushed as a bugfix
scap-security-guide@lists.fedorahosted.org