Skip to content

Properly verify the kernel dump setting #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 16, 2017
Merged

Properly verify the kernel dump setting #52

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8f763e5
Properly verify the kernel dump setting
artem-sidorenko Mar 12, 2017
e3df2db
Verify the dump path only if dumpable is set to suidsafe
artem-sidorenko Mar 13, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 12 additions & 13 deletions controls/sysctl_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,26 +317,25 @@
end
end

control 'sysctl-31' do
control 'sysctl-31a' do
impact 1.0
title 'Secure Core Dumps'
desc 'Ensure that core dumps can never be made by setuid programs or with fully qualified path'
title 'Secure Core Dumps - dump settings'
desc 'Ensure that core dumps can never be made by setuid programs'

describe kernel_parameter('fs.suid_dumpable') do
## those are not valid. how to?
# its(:value) { should eq 0 or should eq 2 }
# its(:value) { should match /[02]/ }
# its(:value) { should match /0|2/ }
its(:value) { should eq 2 }
its(:value) { should cmp(/(0|2)/) }
end
# unless kernel_parameter('fs.suid_dumpable') == 2
# describe kernel_parameter('fs.suid_dumpable') do
# its(:value) { should eq 2 }
# end
end

control 'sysctl-31b' do
impact 1.0
title 'Secure Core Dumps - dump path'
desc 'Ensure that core dumps are done with fully qualified path'
only_if { kernel_parameter('fs.suid_dumpable').value == 2 }

describe kernel_parameter('kernel.core_pattern') do
its(:value) { should match %r{^/.*} }
end
# end
end

control 'sysctl-32' do
Expand Down