[PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check
Shawn Wells
shawn.d.wells at gmail.com
Mon Jan 14 07:42:00 UTC 2013
-------------- next part --------------
>From e7973bb192b23d1185e5c9f925572f81cd6b0bfe Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Mon, 14 Jan 2013 02:35:34 -0500
Subject: [PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check
kernel.randomize_va_space OVAL check should accept values >= 1,
as to not fail users who exceed recommended security settings.
Pushing this as a bugfix.
Testing:
2
Prior to OVAL change:
Title Enable Randomized Layout of Virtual Address Space
Rule enable_randomize_va_space
Ident CCE-26999-3
Result fail
After OVAL change:
Title Enable Randomized Layout of Virtual Address Space
Rule enable_randomize_va_space
Ident CCE-26999-3
Result pass
A thank you goes to Kenneth S. for reporting this bug!
---
.../checks/sysctl_kernel_randomize_va_space.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
index 24dfe55..2633d83 100644
--- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
+++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
@@ -23,6 +23,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_kernel_randomize_va_space" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="greater than or equal">1</unix:value>
</unix:sysctl_state>
</def-group>
--
1.7.1
More information about the scap-security-guide
mailing list