Ensure access to the kernel log is restricted

LowLevel 1Automatedbottlerocket

Description

kernel.dmesg_restrict=1 stops unprivileged processes (including containers) from reading kernel addresses and other sensitive data from dmesg. Bottlerocket /etc is ephemeral, so the value must be persisted through the API. The audit runs "apiclient get settings.kernel.sysctl" (from the admin container root shell or control container): if the API sets kernel.dmesg_restrict it must equal 1; if the API does not set it, the running value in /proc/sys must already equal 1.

How it is checked

Audit method: Shell command

shell

out=$(apiclient get settings.kernel.sysctl 2>/dev/null) || exit 1
v=$(printf '%s' "$out" | tr -d ' \n' | sed -n 's/.*"kernel\.dmesg_restrict":"\([^"]*\)".*/\1/p')
if [ -z "$v" ]; then v=$(cat /proc/sys/kernel/dmesg_restrict 2>/dev/null) || exit 1; fi
[ "$v" = "1" ] && echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set in user data: [settings.kernel.sysctl] "kernel.dmesg_restrict" = "1", or at runtime: apiclient set --json '{"kernel":{"sysctl":{"kernel.dmesg_restrict":"1"}}}'

Properties

Operating systems: Any
Tags: bottlerocketkernelsysctl
Reference: CIS Bottlerocket Benchmark - Kernel parameters / restrict dmesg access (verify section number for your release)

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target bottlerocket