[PATCH] created Rule to restrict access to dmesg

Shawn Wells shawn at redhat.com
Tue Sep 3 16:28:27 UTC 2013


On 9/3/13 12:03 PM, David Smith wrote:
> ---
>   RHEL6/input/system/permissions/execution.xml |   11 +++++++++++
>   1 files changed, 11 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
> index 86d2ea7..081832a 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -199,4 +199,15 @@ allow users to turn the feature on or off at will.</rationale>
>   </Rule>
>   
>   </Group> <!--<Group id="enable_nx"> -->
> +
> +<Rule id="enable_dmesg_restriction">
> +<title>Restrict Access to Kernel Message Buffer</title>
> +<description><sysctl-desc-macro sysctl="kernel.dmesg_restrict" value="1" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.dmesg_restrict" value="1" /></ocil>
> +<rationale>Unprivileged access to the kernel syslog can expose sensitive kernel
> +address information.</rationale>
> +<ident cce="27366-4" />
> +</Rule>
> +
> +
>   </Group> <!--<Group id="restrictions"> -->
Should the new rule be put into a profile?


More information about the scap-security-guide mailing list