[PATCH] [RHEL/6] Search for nousb kernel command line argument in /etc/grub.conf within bootloader_nousb_argument check case-insensitively

Shawn Wells shawn at redhat.com
Thu Apr 17 00:23:31 UTC 2014


On 4/16/14, 5:08 PM, Kayse, Josh wrote:
>
> On Apr 16, 2014, at 8:06 PM, Kayse, Josh <Joshua.Kayse at gtri.gatech.edu 
> <mailto:Joshua.Kayse at gtri.gatech.edu>> wrote:
>
>>
>> On Apr 16, 2014, at 7:59 PM, Shawn Wells <shawn at redhat.com 
>> <mailto:shawn at redhat.com>> wrote:
>>
>>> On 4/16/14, 5:44 AM, Jan Lieskovsky wrote:
>>>> Patch summary:
>>>>    * check for 'nousb' argument on kernel command line in /etc/grub.conf
>>>>      within the bootloader_nousb_argument check in a case-insensitive way
>>>>    * update comments where appropriate
>>>>    * add test attestation timestamp
>>>>    * replace path + filename ind construct with filepath one
>>>>
>>>> Testing report:
>>>>    * Tested on RHEL-6. Works fine.
>>>
>>> I wasn't sure if nousb was case insensitive, so I checked 
>>> https://www.kernel.org/doc/Documentation/kernel-parameters.txt
>>>
>>> And found this:
>>>> Note that ALL kernel parameters listed below are CASE SENSITIVE, and that
>>>> a trailing = on the name of any parameter states that that parameter will
>>>> be entered as an environment variable, whereas its absence indicates that
>>>> it will appear as a kernel argument readable via /proc/cmdline by programs
>>>> running once the system is up.
>>>
>>> "nousb" was in the list as case sensitive.
>>>
>>> Applied your patch (RHEL 6.5), added "nOuSB," and things seem to 
>>> check out. Should we follow the kernel docs (which say case 
>>> sensitive), or allow insensitivity since it actually works?
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org 
>>> <mailto:scap-security-guide at lists.fedorahosted.org>
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>> I’d like to point out that the selinux parameter is also within that 
>> list.  I vote we should follow what actually works and assume the 
>> kernel docs are out of date.
>>
>> -josh
>
> Also, according to 
> https://github.com/torvalds/linux/blame/master/Documentation/kernel-parameters.txt that 
> line was last changed 2005.  Perhaps someone should brave lkml and 
> submit a patch.
>
> -josh

Thanks for that link!

Ack to Jan's patch.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140416/5f6a796d/attachment.html>


More information about the scap-security-guide mailing list