[PATCH 07/22] Added Remediation
Shawn Wells
shawn.d.wells at gmail.com
Mon Sep 16 01:31:16 UTC 2013
-------------- next part --------------
>From e08a5d756c1506e57221264c2de3dc30f7fd1a61 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Wed, 11 Sep 2013 19:35:14 -0400
Subject: [PATCH 07/22] Added Remediation: set_sysctl_fs_suid_dumpable
Built from template
---
.../fixes/bash/set_sysctl_fs_suid_dumpable.sh | 16 ++++++++++++++++
1 files changed, 16 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh
diff --git a/RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh b/RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh
new file mode 100644
index 0000000..640fff2
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for fs.suid_dumpable
+#
+sysctl -q -n -w fs.suid_dumpable=0
+
+#
+# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0"
+# else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf
+#
+if grep --silent ^fs.suid_dumpable /etc/sysctl.conf ; then
+ sed -i 's/^fs.suid_dumpable.*/fs.suid_dumpable = 0/g' /etc/sysctl.conf
+else
+ echo "" >> /etc/sysctl.conf
+ echo "# Set fs.suid_dumpable to 0 per security requirements" >> /etc/sysctl.conf
+ echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf
+fi
--
1.7.1
More information about the scap-security-guide
mailing list