Ensure access to the kernel log is restricted

낮음레벨 1자동bottlerocket

설명

kernel.dmesg_restrict=1 stops unprivileged processes (including containers) from reading kernel addresses and other sensitive data from dmesg. Bottlerocket /etc is ephemeral, so the value must be persisted through the API. The audit runs "apiclient get settings.kernel.sysctl" (from the admin container root shell or control container): if the API sets kernel.dmesg_restrict it must equal 1; if the API does not set it, the running value in /proc/sys must already equal 1.

점검 방법

감사 방식: 셸 명령

shell

out=$(apiclient get settings.kernel.sysctl 2>/dev/null) || exit 1
v=$(printf '%s' "$out" | tr -d ' \n' | sed -n 's/.*"kernel\.dmesg_restrict":"\([^"]*\)".*/\1/p')
if [ -z "$v" ]; then v=$(cat /proc/sys/kernel/dmesg_restrict 2>/dev/null) || exit 1; fi
[ "$v" = "1" ] && echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set in user data: [settings.kernel.sysctl] "kernel.dmesg_restrict" = "1", or at runtime: apiclient set --json '{"kernel":{"sysctl":{"kernel.dmesg_restrict":"1"}}}'

속성

운영 체제: 모두
태그: bottlerocketkernelsysctl
참고 자료: CIS Bottlerocket Benchmark - Kernel parameters / restrict dmesg access (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target bottlerocket