[PATCH 1/2] new rule for restricting access to dmesg
David Smith
dsmith at eclipse.ncsc.mil
Tue Sep 3 20:00:03 UTC 2013
Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
RHEL6/input/system/permissions/execution.xml | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index 86d2ea7..0e2fb5d 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -199,4 +199,16 @@ allow users to turn the feature on or off at will.</rationale>
</Rule>
</Group> <!--<Group id="enable_nx"> -->
+
+<Rule id="enable_dmesg_restriction">
+<title>Restrict Access to Kernel Message Buffer</title>
+<description><sysctl-desc-macro sysctl="kernel.dmesg_restrict" value="1" /></description>
+<ocil><sysctl-check-macro sysctl="kernel.dmesg_restrict" value="1" /></ocil>
+<rationale>Unprivileged access to the kernel syslog can expose sensitive kernel
+address information.</rationale>
+<ident cce="27366-4" />
+<oval id="sysctl_kernel_dmesg_restrict" />
+</Rule>
+
+
</Group> <!--<Group id="restrictions"> -->
--
1.7.1
More information about the scap-security-guide
mailing list