Skip to content

Commit 0677c2d

Browse files
Verify the dump path only if dumpable is set to suidsafe
See this discussion 790371c#commitcomment-21277650
1 parent 8f763e5 commit 0677c2d

File tree

1 file changed

+13
-3
lines changed

1 file changed

+13
-3
lines changed

controls/sysctl_spec.rb

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -317,14 +317,24 @@
317317
end
318318
end
319319

320-
control 'sysctl-31' do
320+
control 'sysctl-31a' do
321321
impact 1.0
322-
title 'Secure Core Dumps'
323-
desc 'Ensure that core dumps can never be made by setuid programs or with fully qualified path'
322+
title 'Secure Core Dumps - dump settings'
323+
desc 'Ensure that core dumps can never be made by setuid programs'
324324

325325
describe kernel_parameter('fs.suid_dumpable') do
326326
its(:value) { should cmp(/(0|2)/) }
327327
end
328+
end
329+
330+
control 'sysctl-31b' do
331+
impact 1.0
332+
title 'Secure Core Dumps - dump path'
333+
desc 'Ensure that core dumps are done with fully qualified path'
334+
only_if do
335+
kernel_parameter('fs.suid_dumpable').value == 2
336+
end
337+
328338
describe kernel_parameter('kernel.core_pattern') do
329339
its(:value) { should match %r{^/.*} }
330340
end

0 commit comments

Comments
 (0)