Mirrors/linux-baseline
2
0
Fork 0
mirror of https://github.com/dev-sec/linux-baseline synced 2024-11-26 21:10:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #52 from artem-sidorenko/kernel-dump

Browse source 
Properly verify the kernel dump setting
This commit is contained in:
Patrick Münch 2017-03-16 08:19:12 +01:00 committed by GitHub
commit 12b317ee26
1 changed files with 12 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
controls/sysctl_spec.rb
View file

@ -317,26 +317,25 @@ control 'sysctl-30' do
end end
end end
control 'sysctl-31' do control 'sysctl-31a' do
impact 1.0 impact 1.0
title 'Secure Core Dumps' title 'Secure Core Dumps - dump settings'
desc 'Ensure that core dumps can never be made by setuid programs or with fully qualified path' desc 'Ensure that core dumps can never be made by setuid programs'
describe kernel_parameter('fs.suid_dumpable') do describe kernel_parameter('fs.suid_dumpable') do
## those are not valid. how to? its(:value) { should cmp(/(0|2)/) }
# its(:value) { should eq 0 or should eq 2 }
# its(:value) { should match /[02]/ }
# its(:value) { should match /0|2/ }
its(:value) { should eq 2 }
end end
# unless kernel_parameter('fs.suid_dumpable') == 2 end
# describe kernel_parameter('fs.suid_dumpable') do
# its(:value) { should eq 2 } control 'sysctl-31b' do
# end impact 1.0
title 'Secure Core Dumps - dump path'
desc 'Ensure that core dumps are done with fully qualified path'
only_if { kernel_parameter('fs.suid_dumpable').value == 2 }
describe kernel_parameter('kernel.core_pattern') do describe kernel_parameter('kernel.core_pattern') do
its(:value) { should match %r{^/.*} } its(:value) { should match %r{^/.*} }
end end
# end
end end
control 'sysctl-32' do control 'sysctl-32' do