Ensure kernel.yama.ptrace_scope is configured

SrednjaNivo 1Automatskalinux

Opis

The ptrace() system call provides a means by which one process (the "tracer") may observe and control the execution of another process (the "tracee"), and examine and change the tracee's memory and registers. The sysctl settings (writable only with CAP_SYS_PTRACE) are: • 0 - classic ptrace permissions: a process can PTRACE_ATTACH to any other process running under the same uid, as long as it is dumpable (i.e. did not transition uids, start privileged, or have called prctl(PR_SET_DUMPABLE...) already). Similarly, PTRACE_TRACEME is unchanged. • 1 - restricted ptrace: a process must have a predef

Kako se proverava

Metod provere: Komanda ljuske

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.yama.ptrace_scope '1 2 3'; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

1. Review all files being used by systemd sysctl and comment out or remove all kernel.yama.ptrace_scope lines that are not kernel.yama.ptrace_scope=1, kernel.yama.ptrace_scope=2, or kernel.yama.ptrace_scope=3. Example script: #!/usr/bin/env bash { l_option="kernel.yama.ptrace_scope" l_value="(1|2|3)" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" l_ufw_file="$([ -f /etc/default/ufw ] && \ awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)" [ -f "$(readlink -e "$l_ufw_file")" ] && \ a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(re…

Svojstva

Operativni sistemi: rocky-10
Oznake: cis-convertedkernellinuxsysctl
Referenca: CIS Rocky Linux 10 Benchmark v1.0.0 - 1.5.7

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target linux