[PATCH] [RHEL/6] Search for nousb kernel command line argument in /etc/grub.conf within bootloader_nousb_argument check case-insensitively

Trevor Vaughan tvaughan at onyxpoint.com
Thu Apr 17 19:17:07 UTC 2014


Virtual machines -> Touche! I always forget about that.

Are we going to have something like Facter on the system to be able to
discover if they are virtual or not?

If we could do that, we might stand a shot but without it, I don't know of
a good way of doing this across a VM cluster in terms of checking with OVAL
rules.

Trevor


On Thu, Apr 17, 2014 at 2:57 PM, Shawn Wells <shawn at redhat.com> wrote:

>  On 4/17/14, 5:11 AM, Trevor Vaughan wrote:
>
> Just out of curiosity, is adding nousb to the grub command line actually
> feasible for enforcement?
>
>
> Virtual machines.
>
>  I can't remember the last time I used a system where I didn't need a USB
> keyboard at some point (can you even buy server class systems with PS/2
> support any more?)
>
>
> Complete agreement, and acknowledgement in the rule's description:
>
>  *WARNING: Disabling all kernel support for USB will cause problems for
> systems with USB-based keyboards, mice, or printers. This configuration is
> infeasible for systems which require USB devices, which is common.*
>
>
> Patches welcome which clarify/balance physical deployments vs VMs.
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>


-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140417/1beb8ef8/attachment-0001.html>


More information about the scap-security-guide mailing list