[PATCH 1/2] new rule for restricting access to dmesg

David Smith dsmith at eclipse.ncsc.mil
Tue Sep 3 20:00:03 UTC 2013


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/system/permissions/execution.xml |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index 86d2ea7..0e2fb5d 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -199,4 +199,16 @@ allow users to turn the feature on or off at will.</rationale>
 </Rule>
 
 </Group> <!--<Group id="enable_nx"> -->
+
+<Rule id="enable_dmesg_restriction">
+<title>Restrict Access to Kernel Message Buffer</title>
+<description><sysctl-desc-macro sysctl="kernel.dmesg_restrict" value="1" /></description>
+<ocil><sysctl-check-macro sysctl="kernel.dmesg_restrict" value="1" /></ocil>
+<rationale>Unprivileged access to the kernel syslog can expose sensitive kernel 
+address information.</rationale>
+<ident cce="27366-4" />
+<oval id="sysctl_kernel_dmesg_restrict" />
+</Rule> 
+  
+
 </Group> <!--<Group id="restrictions"> -->
-- 
1.7.1



More information about the scap-security-guide mailing list