[PATCH] created Rule to restrict access to dmesg
David Smith
dsmith at eclipse.ncsc.mil
Tue Sep 3 16:03:42 UTC 2013
---
RHEL6/input/system/permissions/execution.xml | 11 +++++++++++
1 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index 86d2ea7..081832a 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -199,4 +199,15 @@ allow users to turn the feature on or off at will.</rationale>
</Rule>
</Group> <!--<Group id="enable_nx"> -->
+
+<Rule id="enable_dmesg_restriction">
+<title>Restrict Access to Kernel Message Buffer</title>
+<description><sysctl-desc-macro sysctl="kernel.dmesg_restrict" value="1" /></description>
+<ocil><sysctl-check-macro sysctl="kernel.dmesg_restrict" value="1" /></ocil>
+<rationale>Unprivileged access to the kernel syslog can expose sensitive kernel
+address information.</rationale>
+<ident cce="27366-4" />
+</Rule>
+
+
</Group> <!--<Group id="restrictions"> -->
--
1.7.1
More information about the scap-security-guide
mailing list