[PATCH] [RHEL/6] Search for nousb kernel command line argument in /etc/grub.conf within bootloader_nousb_argument check case-insensitively
Shawn Wells
shawn at redhat.com
Thu Apr 17 00:23:31 UTC 2014
On 4/16/14, 5:08 PM, Kayse, Josh wrote:
>
> On Apr 16, 2014, at 8:06 PM, Kayse, Josh <Joshua.Kayse at gtri.gatech.edu
> <mailto:Joshua.Kayse at gtri.gatech.edu>> wrote:
>
>>
>> On Apr 16, 2014, at 7:59 PM, Shawn Wells <shawn at redhat.com
>> <mailto:shawn at redhat.com>> wrote:
>>
>>> On 4/16/14, 5:44 AM, Jan Lieskovsky wrote:
>>>> Patch summary:
>>>> * check for 'nousb' argument on kernel command line in /etc/grub.conf
>>>> within the bootloader_nousb_argument check in a case-insensitive way
>>>> * update comments where appropriate
>>>> * add test attestation timestamp
>>>> * replace path + filename ind construct with filepath one
>>>>
>>>> Testing report:
>>>> * Tested on RHEL-6. Works fine.
>>>
>>> I wasn't sure if nousb was case insensitive, so I checked
>>> https://www.kernel.org/doc/Documentation/kernel-parameters.txt
>>>
>>> And found this:
>>>> Note that ALL kernel parameters listed below are CASE SENSITIVE, and that
>>>> a trailing = on the name of any parameter states that that parameter will
>>>> be entered as an environment variable, whereas its absence indicates that
>>>> it will appear as a kernel argument readable via /proc/cmdline by programs
>>>> running once the system is up.
>>>
>>> "nousb" was in the list as case sensitive.
>>>
>>> Applied your patch (RHEL 6.5), added "nOuSB," and things seem to
>>> check out. Should we follow the kernel docs (which say case
>>> sensitive), or allow insensitivity since it actually works?
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> <mailto:scap-security-guide at lists.fedorahosted.org>
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>> I’d like to point out that the selinux parameter is also within that
>> list. I vote we should follow what actually works and assume the
>> kernel docs are out of date.
>>
>> -josh
>
> Also, according to
> https://github.com/torvalds/linux/blame/master/Documentation/kernel-parameters.txt that
> line was last changed 2005. Perhaps someone should brave lkml and
> submit a patch.
>
> -josh
Thanks for that link!
Ack to Jan's patch.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140416/5f6a796d/attachment.html>
More information about the scap-security-guide
mailing list