[PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check

Shawn Wells shawn at redhat.com
Wed Jan 16 01:27:46 UTC 2013


On 1/14/13 2:42 AM, Shawn Wells wrote:
>
> 0001-bugfix-Fixed-kernel.randomize_va_space-OVAL-check.patch
>
>
>  From e7973bb192b23d1185e5c9f925572f81cd6b0bfe Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Mon, 14 Jan 2013 02:35:34 -0500
> Subject: [PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check
>
> kernel.randomize_va_space OVAL check should accept values >= 1,
> as to not fail users who exceed recommended security settings.
>
> Pushing this as a bugfix.
>
> Testing:
> 2
>
> Prior to OVAL change:
> Title Enable Randomized Layout of Virtual Address Space
> Rule  enable_randomize_va_space
> Ident CCE-26999-3
> Result        fail
>
> After OVAL change:
> Title Enable Randomized Layout of Virtual Address Space
> Rule  enable_randomize_va_space
> Ident CCE-26999-3
> Result        pass
>
> A thank you goes to Kenneth S. for reporting this bug!
> ---
>   .../checks/sysctl_kernel_randomize_va_space.xml    |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
> index 24dfe55..2633d83 100644
> --- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
> +++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
> @@ -23,6 +23,6 @@
>     </unix:sysctl_object>
>   
>     <unix:sysctl_state id="state_sysctl_kernel_randomize_va_space" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="greater than or equal">1</unix:value>
>     </unix:sysctl_state>
>   </def-group>
> -- 1.7.1



Pushed as a bugfix
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130115/3d587a20/attachment.html>


More information about the scap-security-guide mailing list