[PATCH 2/2] new OVAL check for kernel.dmesg_restrict
David Smith
dsmith at eclipse.ncsc.mil
Tue Sep 3 20:00:04 UTC 2013
[dave at rhel6 checks] sysctl kernel.dmesg_restrict ; ./testcheck.py sysctl_kernel_dmesg_restrict.xml
kernel.dmesg_restrict = 1
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_dmesg_restrictH4fcfB.xml
Writing results to : /tmp/sysctl_kernel_dmesg_restrictH4fcfB.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
.../input/checks/sysctl_kernel_dmesg_restrict.xml | 28 ++++++++++++++++++++
RHEL6/input/checks/templates/sysctl_values.csv | 1 +
2 files changed, 29 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
diff --git a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
new file mode 100644
index 0000000..c386a1d
--- /dev/null
+++ b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
+ <definition class="compliance" id="sysctl_kernel_dmesg_restrict" version="1">
+ <metadata>
+ <title>Kernel Runtime Parameter "kernel.dmesg_restrict" Check</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The kernel runtime parameter "kernel.dmesg_restrict" should be set to "1".</description>
+ </metadata>
+ <criteria>
+ <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="test_sysctl_kernel_dmesg_restrict" />
+ </criteria>
+ </definition>
+
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="test_sysctl_kernel_dmesg_restrict" version="1">
+ <unix:object object_ref="object_sysctl_kernel_dmesg_restrict" />
+ <unix:state state_ref="state_sysctl_kernel_dmesg_restrict" />
+ </unix:sysctl_test>
+
+ <unix:sysctl_object id="object_sysctl_kernel_dmesg_restrict" version="1">
+ <unix:name>kernel.dmesg_restrict</unix:name>
+ </unix:sysctl_object>
+
+ <unix:sysctl_state id="state_sysctl_kernel_dmesg_restrict" version="1">
+ <unix:value datatype="int" operation="equals">1</unix:value>
+ </unix:sysctl_state>
+</def-group>
diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv
index b318c47..ac4b285 100644
--- a/RHEL6/input/checks/templates/sysctl_values.csv
+++ b/RHEL6/input/checks/templates/sysctl_values.csv
@@ -1,5 +1,6 @@
kernel.exec-shield,1
kernel.randomize_va_space,2
+kernel.dmesg_restrict,1
net.ipv4.conf.all.accept_redirects,0
net.ipv4.conf.all.accept_source_route,0
net.ipv4.conf.all.log_martians,1
--
1.7.1
More information about the scap-security-guide
mailing list