[PATCH 2/2] new OVAL check for kernel.dmesg_restrict

David Smith dsmith at eclipse.ncsc.mil
Tue Sep 3 20:00:04 UTC 2013


[dave at rhel6 checks] sysctl kernel.dmesg_restrict ; ./testcheck.py sysctl_kernel_dmesg_restrict.xml
kernel.dmesg_restrict = 1
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_dmesg_restrictH4fcfB.xml
Writing results to : /tmp/sysctl_kernel_dmesg_restrictH4fcfB.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.

Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 .../input/checks/sysctl_kernel_dmesg_restrict.xml  |   28 ++++++++++++++++++++
 RHEL6/input/checks/templates/sysctl_values.csv     |    1 +
 2 files changed, 29 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml

diff --git a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
new file mode 100644
index 0000000..c386a1d
--- /dev/null
+++ b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="sysctl_kernel_dmesg_restrict" version="1">
+    <metadata>
+      <title>Kernel Runtime Parameter "kernel.dmesg_restrict" Check</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The kernel runtime parameter "kernel.dmesg_restrict" should be set to "1".</description>
+    </metadata>
+    <criteria>
+      <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="test_sysctl_kernel_dmesg_restrict" />
+    </criteria>
+  </definition>
+
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="test_sysctl_kernel_dmesg_restrict" version="1">
+    <unix:object object_ref="object_sysctl_kernel_dmesg_restrict" />
+    <unix:state state_ref="state_sysctl_kernel_dmesg_restrict" />
+  </unix:sysctl_test>
+
+  <unix:sysctl_object id="object_sysctl_kernel_dmesg_restrict" version="1">
+    <unix:name>kernel.dmesg_restrict</unix:name>
+  </unix:sysctl_object>
+
+  <unix:sysctl_state id="state_sysctl_kernel_dmesg_restrict" version="1">
+    <unix:value datatype="int" operation="equals">1</unix:value>
+  </unix:sysctl_state>
+</def-group>
diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv
index b318c47..ac4b285 100644
--- a/RHEL6/input/checks/templates/sysctl_values.csv
+++ b/RHEL6/input/checks/templates/sysctl_values.csv
@@ -1,5 +1,6 @@
 kernel.exec-shield,1
 kernel.randomize_va_space,2
+kernel.dmesg_restrict,1
 net.ipv4.conf.all.accept_redirects,0
 net.ipv4.conf.all.accept_source_route,0
 net.ipv4.conf.all.log_martians,1
-- 
1.7.1



More information about the scap-security-guide mailing list