Mirrors/linux-baseline
2
0
Fork 0
mirror of https://github.com/dev-sec/linux-baseline synced 2024-11-22 19:23:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #52 from artem-sidorenko/kernel-dump

Browse source 
Properly verify the kernel dump setting
This commit is contained in:
Patrick Münch 2017-03-16 08:19:12 +01:00 committed by GitHub
commit 12b317ee26
1 changed files with 12 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
controls/sysctl_spec.rb
View file

@ -317,26 +317,25 @@ control 'sysctl-30' do
end
end
control 'sysctl-31' do
control 'sysctl-31a' do
impact 1.0
title 'Secure Core Dumps'
desc 'Ensure that core dumps can never be made by setuid programs or with fully qualified path'
title 'Secure Core Dumps - dump settings'
desc 'Ensure that core dumps can never be made by setuid programs'
describe kernel_parameter('fs.suid_dumpable') do
## those are not valid. how to?
# its(:value) { should eq 0 or should eq 2 }
# its(:value) { should match /[02]/ }
# its(:value) { should match /0|2/ }
its(:value) { should eq 2 }
its(:value) { should cmp(/(0|2)/) }
end
# unless kernel_parameter('fs.suid_dumpable') == 2
# describe kernel_parameter('fs.suid_dumpable') do
# its(:value) { should eq 2 }
# end
end
control 'sysctl-31b' do
impact 1.0
title 'Secure Core Dumps - dump path'
desc 'Ensure that core dumps are done with fully qualified path'
only_if { kernel_parameter('fs.suid_dumpable').value == 2 }
describe kernel_parameter('kernel.core_pattern') do
its(:value) { should match %r{^/.*} }
end
# end
end
control 'sysctl-32' do