<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 1/14/13 2:42 AM, Shawn Wells wrote:<br>
</div>
<blockquote cite="mid:20130114074200.GA23855@mail.corp.redhat.com"
type="cite">
<br>
<fieldset class="mimeAttachmentHeader"><legend
class="mimeAttachmentHeaderName">0001-bugfix-Fixed-kernel.randomize_va_space-OVAL-check.patch</legend></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">From e7973bb192b23d1185e5c9f925572f81cd6b0bfe Mon Sep 17 00:00:00 2001
From: Shawn Wells <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:shawn@redhat.com"><shawn@redhat.com></a>
Date: Mon, 14 Jan 2013 02:35:34 -0500
Subject: [PATCH] [bugfix] Fixed kernel.randomize_va_space OVAL check
kernel.randomize_va_space OVAL check should accept values >= 1,
as to not fail users who exceed recommended security settings.
Pushing this as a bugfix.
Testing:
2
Prior to OVAL change:
Title Enable Randomized Layout of Virtual Address Space
Rule enable_randomize_va_space
Ident CCE-26999-3
Result fail
After OVAL change:
Title Enable Randomized Layout of Virtual Address Space
Rule enable_randomize_va_space
Ident CCE-26999-3
Result pass
A thank you goes to Kenneth S. for reporting this bug!
---
.../checks/sysctl_kernel_randomize_va_space.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
index 24dfe55..2633d83 100644
--- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
+++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
@@ -23,6 +23,6 @@
</unix:sysctl_object>
<unix:sysctl_state id="state_sysctl_kernel_randomize_va_space" version="1">
- <unix:value datatype="int" operation="equals">1</unix:value>
+ <unix:value datatype="int" operation="greater than or equal">1</unix:value>
</unix:sysctl_state>
</def-group>
<div class="moz-txt-sig">--
1.7.1
</div></pre>
</div>
</blockquote>
<br>
<br>
<br>
Pushed as a bugfix<br>
</body>
</html>