Ensure fs.suid_dumpable is configured

СреднийУровень 1Автоматическаяlinux

Описание

fs.suid_dumpable governs whether a privileged process (with the setuid bit) can generate a core dump, regardless of other configurations. fs.suid_dumpable values: • 0 (default) - Any process that has changed privilege levels (like SUID programs) or is execute-only will not dump core. • 1 (debug) - All processes dump core if possible. The core dump is owned by the current user and security is not applied. This is primarily intended for system debugging. • 2 (suidsafe) - Any binary that normally wouldn't be dumped is dumped, but only if the core_pattern is set to a pipe handler or a fully qualif

Как проверяется

Метод проверки: Команда оболочки

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk fs.suid_dumpable 0; then echo compliant; fi

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

1. Review all files being used by systemd sysctl and comment out or remove all fs.suid_dumpable lines that are not fs.suid_dumpable=0. Example script: #!/usr/bin/env bash { l_option="fs.suid_dumpable" l_value="0" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" l_ufw_file="$([ -f /etc/default/ufw ] && \ awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)" [ -f "$(readlink -e "$l_ufw_file")" ] && \ a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' …

Свойства

Операционные системы: almalinux-8
Теги: cis-convertedkernellinuxsysctl
Источник: CIS AlmaLinux OS 8 Benchmark v4.0.0 - 1.5.4

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target linux