Ensure kernel.kptr_restrict is configured

СредњаНиво 1Аутоматскаlinux

Опис

kernel.kptr_restrict sets whether restrictions are placed on exposing kernel addresses via /proc and other interfaces. • kptr_restrict = 0 - The address is hashed before printing. (equivalent to %p.) • kptr_restrict = 1 - kernel pointers printed using the %pK format specifier will be replaced with 0's. • kptr_restrict = 2 - kernel pointers printed using %pK will be replaced with 0's regardless of privileges. More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Како се проверава

Метод провере: Команда љуске

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.kptr_restrict '1 2'; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

1. Review all files being used by systemd sysctl and comment out or remove all kernel.kptr_restrict lines that are not kernel.kptr_restrict=1 or kernel.kptr_restrict=2. Example script: #!/usr/bin/env bash { l_option="kernel.kptr_restrict" l_value="(1|2)" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \ <<< "${a_files[*]}" && a_files+=("$l_file") done < <("$l_systemdsysctl" --cat-config | tac | \ grep -Pio '^\h*#\h*\/[^#\n\r\h]…

Својства

Оперативни системи: rocky-9
Ознаке: cis-convertedkernellinuxsysctl
Референца: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.5.5

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux