[PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check

Shawn Wells shawn.d.wells at gmail.com
Mon Jan 14 07:42:00 UTC 2013


-------------- next part --------------
>From e7973bb192b23d1185e5c9f925572f81cd6b0bfe Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Mon, 14 Jan 2013 02:35:34 -0500
Subject: [PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check

kernel.randomize_va_space OVAL check should accept values >= 1,
as to not fail users who exceed recommended security settings.

Pushing this as a bugfix.

Testing:
2

Prior to OVAL change:
Title Enable Randomized Layout of Virtual Address Space
Rule  enable_randomize_va_space
Ident CCE-26999-3
Result        fail

After OVAL change:
Title Enable Randomized Layout of Virtual Address Space
Rule  enable_randomize_va_space
Ident CCE-26999-3
Result        pass

A thank you goes to Kenneth S. for reporting this bug!
---
 .../checks/sysctl_kernel_randomize_va_space.xml    |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
index 24dfe55..2633d83 100644
--- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
+++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
@@ -23,6 +23,6 @@
   </unix:sysctl_object>
 
   <unix:sysctl_state id="state_sysctl_kernel_randomize_va_space" version="1">
-    <unix:value datatype="int" operation="equals">1</unix:value>
+    <unix:value datatype="int" operation="greater than or equal">1</unix:value>
   </unix:sysctl_state>
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list