Ensure access to the kernel log is restricted

BajaNivel 1Automatizadabottlerocket

Descripción

kernel.dmesg_restrict=1 stops unprivileged processes (including containers) from reading kernel addresses and other sensitive data from dmesg. Bottlerocket /etc is ephemeral, so the value must be persisted through the API. The audit runs "apiclient get settings.kernel.sysctl" (from the admin container root shell or control container): if the API sets kernel.dmesg_restrict it must equal 1; if the API does not set it, the running value in /proc/sys must already equal 1.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(apiclient get settings.kernel.sysctl 2>/dev/null) || exit 1
v=$(printf '%s' "$out" | tr -d ' \n' | sed -n 's/.*"kernel\.dmesg_restrict":"\([^"]*\)".*/\1/p')
if [ -z "$v" ]; then v=$(cat /proc/sys/kernel/dmesg_restrict 2>/dev/null) || exit 1; fi
[ "$v" = "1" ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set in user data: [settings.kernel.sysctl] "kernel.dmesg_restrict" = "1", or at runtime: apiclient set --json '{"kernel":{"sysctl":{"kernel.dmesg_restrict":"1"}}}'

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: bottlerocketkernelsysctl
Referencia: CIS Bottlerocket Benchmark - Kernel parameters / restrict dmesg access (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bottlerocket