<div dir="ltr"><div>That&#39;s a really good question.<br><br>If it&#39;s implemented in the same way as modprobe.d, then later files will be able to override earlier ones.<br><br></div><div>So, if they were consistent (hahaha), then that might be the answer.<br><br></div>Trevor<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 21, 2015 at 2:34 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Our current sysctl checks simultaneously check the runtime of the system (via unix:sysctl_test) and the persistent configuration (regex on sysctl.conf). We know these need to be broken out, and that&#39;s being tracked in Issue #321 [1].<br>
<br>
So then, to actually take action, it seems like we need to:<br>
(1) Breakout the *runtime* checks into unique XCCDF and OVAL elements. The OVAL will utilize unix:sysctl_test;<br>
(2) Breakout the *persistent* checks.<br>
<br>
On the persistent/static configuration side, from the sysctl manpage [2] there are now 6 locations to bury persistent sysctl settings:<br>
<br>
/etc/sysctl/*.conf<br>
/usr/local/lib/sysctl.d/*.conf<br>
/usr/lib/sysctl.d/*.conf<br>
/lib/sysctl.d/*.conf<br>
/etc/sysctl.conf<br>
<br>
I can&#39;t find documentation on the &quot;order of operations&quot; on how sysctl directories are scanned (aka, if a setting is placed in /usr/lib/sysctl.d/, will /etc/sysctl/*.conf overwrite it?). Has anyone seen any order of operations documentation on sysctl? My google-fu is failing today =/<br>
<br>
>From the upstream source, I get the idea that /etc/sysctl.conf overwrites everything [3], but unsure of the other paths. The closest indication I could find was where  PreLoadSystem() defines their dir[] array [4], which shows:<br>
<br>
- /run/sysctl.d (ignored, will be checked by runtime OVAL check)<br>
- /etc/sysctl.d/<br>
- /usr/local/lib/sysctl.d/<br>
- /usr/lib/sysctl.d/<br>
- /lib/sysctl.d/<br>
<br>
As a side note, it looks like the code only checks *.conf files in those directories, so we can ignore everything else [5].<br>
<br>
<br>
<br>
<br>
[1] <a href="https://github.com/OpenSCAP/scap-security-guide/issues/321" target="_blank">https://github.com/OpenSCAP/<u></u>scap-security-guide/issues/321</a><br>
[2] <a href="http://man7.org/linux/man-pages/man5/sysctl.conf.5.html" target="_blank">http://man7.org/linux/man-<u></u>pages/man5/sysctl.conf.5.html</a><br>
[3] <a href="https://gitorious.org/procps/procps/source/fc7cb8dd4cd91da3d2df35b8863247674e4fd1ed:sysctl.c#L55" target="_blank">https://gitorious.org/procps/<u></u>procps/source/<u></u>fc7cb8dd4cd91da3d2df35b8863247<u></u>674e4fd1ed:sysctl.c#L55</a><br>
[4] <a href="https://gitorious.org/procps/procps/source/fc7cb8dd4cd91da3d2df35b8863247674e4fd1ed:sysctl.c#L584-593" target="_blank">https://gitorious.org/procps/<u></u>procps/source/<u></u>fc7cb8dd4cd91da3d2df35b8863247<u></u>674e4fd1ed:sysctl.c#L584-593</a><br>
[5] <a href="https://gitorious.org/procps/procps/source/fc7cb8dd4cd91da3d2df35b8863247674e4fd1ed:sysctl.c#L607-611" target="_blank">https://gitorious.org/procps/<u></u>procps/source/<u></u>fc7cb8dd4cd91da3d2df35b8863247<u></u>674e4fd1ed:sysctl.c#L607-611</a><span class="HOEnZb"><font color="#888888"><br>
-- <br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/<u></u>scap-security-guide/</a></font></span></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature">Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --</div>
</div>