<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/30/13, 11:35 AM, Dave Smith
wrote:<br>
</div>
<blockquote cite="mid:529A13EE.9050105@scapsecurityguides.org"
type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">This looks great, please push!<br>
<br>
On 11/27/2013 10:40 AM, Jan Lieskovsky wrote:<br>
</div>
<blockquote
cite="mid:713840356.9158997.1385566829539.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">Proposal for the "2.1.3.1.b. Disable Prelinking"
rule remediation.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
<blockquote type="cite"><br>
<fieldset class="mimeAttachmentHeader"><legend
class="mimeAttachmentHeaderName">0001-RHEL6-Add-remediation-for-Disable-Prelinking-rule.patch</legend></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">From 102d335388c881e6f825b48c54e33f0e1e623767 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com"><jlieskov@redhat.com></a>
Date: Wed, 27 Nov 2013 16:36:04 +0100
Subject: [PATCH] [RHEL6] Add remediation for Disable Prelinking rule
Signed-off-by: Jan Lieskovsky <a class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com"><jlieskov@redhat.com></a>
---
RHEL6/input/fixes/bash/disable_prelink.sh | 9 +++++++++
1 file changed, 9 insertions(+)
create mode 100644 RHEL6/input/fixes/bash/disable_prelink.sh
diff --git a/RHEL6/input/fixes/bash/disable_prelink.sh b/RHEL6/input/fixes/bash/disable_prelink.sh
new file mode 100644
index 0000000..98dc85d
--- /dev/null
+++ b/RHEL6/input/fixes/bash/disable_prelink.sh
@@ -0,0 +1,9 @@
+#
+# Disable prelinking altogether
+#
+sed -i "s/PRELINKING.*/PRELINKING=no/g" /etc/sysconfig/prelink
+
+#
+# Undo previous prelink changes to binaries
+#
+/usr/sbin/prelink -ua
<div class="moz-txt-sig">--
1.8.3.1
</div></pre>
</div>
</blockquote>
</blockquote>
</blockquote>
<br>
<br>
What if PRELINK was commented out? e.g.<br>
<br>
# grep PRELINKING /etc/sysconfig/prelink<br>
#PRELINKING=commented<br>
[root@SSG-RHEL6 shared]# sed -i "s/PRELINKING.*/PRELINKING=no/g"
/etc/sysconfig/prelink<br>
[root@SSG-RHEL6 shared]# grep PRELINKING /etc/sysconfig/prelink<br>
#PRELINKING=no<br>
<br>
<br>
That's why the sysctl (+others) use something like:<br>
<br>
if grep --silent ^PRELINKING /etc/sysconfig/prelink ; then<br>
sed -i 's/^PRELINKING.*/PRELINKING=no/g'
/etc/sysconfig/prelink<br>
else<br>
echo "" >> /etc/sysconfig/prelink<br>
echo "# Set PRELINKING=no per security requirements" >>
/etc/sysconfig/prelink<br>
echo "PRELINKING=no" >> /etc/sysconfig/prelink
</body>
</html>