From 694af59f0c400d34b11e80b29b66cdb82ad080b6 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 27 Jul 2022 13:49:05 +0200 Subject: [PATCH 1/8] remove unneeded coredump related rules from rhel9 ospp --- products/rhel9/profiles/ospp.profile | 3 --- 1 file changed, 3 deletions(-) diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile index dcc41970043..0902abf58db 100644 --- a/products/rhel9/profiles/ospp.profile +++ b/products/rhel9/profiles/ospp.profile @@ -110,10 +110,7 @@ selections: - package_gnutls-utils_installed ### Login - - disable_users_coredumps - sysctl_kernel_core_pattern - - coredump_disable_storage - - coredump_disable_backtraces - service_systemd-coredump_disabled - var_authselect_profile=minimal - enable_authselect From da50ca7abc0358b6b5db72f26173843454461dcf Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 3 Aug 2022 12:17:27 +0200 Subject: [PATCH 2/8] remove conditional from sysctl templated OVAL actually now it is quite common that the sysctlval can be undefined. In this case, XCCDF variable is used. See documentation for sysctl template. I don't think there is a need to have this special regex. Moreover, the regex was checking only for numbers. --- shared/templates/sysctl/oval.template | 5 ----- 1 file changed, 5 deletions(-) diff --git a/shared/templates/sysctl/oval.template b/shared/templates/sysctl/oval.template index 1a7c4979bbe..e0c6f72f928 100644 --- a/shared/templates/sysctl/oval.template +++ b/shared/templates/sysctl/oval.template @@ -17,13 +17,8 @@ {{% endif %}} {{%- endmacro -%}} {{%- macro sysctl_match() -%}} -{{%- if SYSCTLVAL == "" -%}} - ^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*(\d+)[\s]*$ - 1 -{{%- else -%}} ^[\s]*{{{ SYSCTLVAR }}}[\s]*=[\s]*(.*)[\s]*$ 1 -{{%- endif -%}} {{%- endmacro -%}} {{%- if "P" in FLAGS -%}} From 9b9110cd969afe7ba3796030a33dd795432a9373 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 3 Aug 2022 13:00:45 +0200 Subject: [PATCH 3/8] add new rule sysctl_kernel_core_uses_pid --- .../sysctl_kernel_core_uses_pid/rule.yml | 36 +++++++++++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml new file mode 100644 index 00000000000..7fa36fb940e --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml @@ -0,0 +1,36 @@ +documentation_complete: true + +prodtype: fedora,ol8,ol9,rhcos4,rhel8,rhel9 + +title: 'Configure file name of core dumps' + +description: '{{{ describe_sysctl_option_value(sysctl="kernel.core_uses_pid", value=0) }}}' + +rationale: |- + The default coredump filename is 
core
. By setting + 
core_uses_pid
to 
1
, the coredump filename becomes + 
core.PID
. If 
core_pattern
does not include + 
%p
(default does not) and 
core_uses_pid
is set, then + 
.PID
will be appended to the filename. + +severity: medium + +identifiers: + cce@rhel9: CCE-86003-1 + +references: + ospp: FMT_SMF_EXT.1 + +ocil_clause: 'the returned line does not have a value of 0, or a line is not returned and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement' + +ocil: |- + {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value=0) }}} + +platform: machine + +template: + name: sysctl + vars: + sysctlvar: kernel.core_uses_pid + datatype: int + sysctlval: '0' From 04dbd2db9469082a450e9b062d91e47190abe552 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 5 Aug 2022 09:08:37 +0200 Subject: [PATCH 4/8] add new rule setting kernel.core_pattern to empty string --- .../rule.yml | 49 +++++++++++++++++++ 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml new file mode 100644 index 00000000000..089bb1481aa --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml @@ -0,0 +1,49 @@ +documentation_complete: true + +prodtype: fedora,ol8,ol9,rhcos4,rhel8,rhel9 + +title: 'Disable storing core dumps' + +description: |- + The kernel.core_pattern option specifies the core dumpfile pattern + name. It can be set to an empty string ''. In this case, the kernel + behaves differently based on another related option. If + kernel.core_uses_pid is set to 1, then a file named as + .PID (where PID is process ID of the crashed process) is + created in the working directory. If kernel.core_uses_pid is set to + 0, no coredump is saved. + {{{ describe_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}}' + +rationale: |- + A core dump includes a memory image taken at the time the operating system + terminates an application. The memory image could contain sensitive data and is generally useful + only for developers trying to debug problems. + +severity: medium + +requires: + - sysctl_kernel_core_uses_pid + +conflicts: + - sysctl_kernel_core_pattern + +identifiers: + cce@rhel9: CCE-86005-6 + +references: + ospp: FMT_SMF_EXT.1 + +ocil_clause: |- + the returned line does not have a value of ''. + +ocil: | + {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}} + +platform: machine + +template: + name: sysctl + vars: + sysctlvar: kernel.core_pattern + sysctlval: "''" + datatype: string From 42690d39487d5483693fc4ce32c0c95d11ee3203 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 5 Aug 2022 10:40:47 +0200 Subject: [PATCH 5/8] add rule to RHEL9 OSPP profile --- products/rhel9/profiles/ospp.profile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile index 0902abf58db..b1b18261d48 100644 --- a/products/rhel9/profiles/ospp.profile +++ b/products/rhel9/profiles/ospp.profile @@ -110,7 +110,8 @@ selections: - package_gnutls-utils_installed ### Login - - sysctl_kernel_core_pattern + - sysctl_kernel_core_pattern_empty_string + - sysctl_kernel_core_uses_pid - service_systemd-coredump_disabled - var_authselect_profile=minimal - enable_authselect From d7e194f1998757d3b5a7691c598a71549215f97b Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 3 Aug 2022 13:01:12 +0200 Subject: [PATCH 6/8] describe beneficial dependency between sysctl_kernel_core_pattern_empty_string and sysctl:kernel_core_uses_pid --- .../sysctl_kernel_core_uses_pid/rule.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml index 7fa36fb940e..d6d2c468c10 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml @@ -7,11 +7,14 @@ title: 'Configure file name of core dumps' description: '{{{ describe_sysctl_option_value(sysctl="kernel.core_uses_pid", value=0) }}}' rationale: |- - The default coredump filename is 
core
. By setting - 
core_uses_pid
to 
1
, the coredump filename becomes - 
core.PID
. If 
core_pattern
does not include - 
%p
(default does not) and 
core_uses_pid
is set, then - 
.PID
will be appended to the filename. + The default coredump filename is core. By setting + core_uses_pid to 1, the coredump filename becomes + core.PID. If core_pattern does not include + %p (default does not) and core_uses_pid is set, then + .PID will be appended to the filename. + When combined with kernel.core_pattern = "" configuration, it + is ensured that no core dumps are generated and also no confusing error + messages are printed by a shell. severity: medium From cd0f5491d57bf42e5901c681e290a9378eade3e6 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Fri, 5 Aug 2022 10:53:37 +0200 Subject: [PATCH 7/8] make sysctl_kernel_core_pattern conflicting with sysctl_kernel_core_pattern_empty_string they are modifying the same configuration --- .../restrictions/sysctl_kernel_core_pattern/rule.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml index 771c4d40e0f..c27a9e7ecf3 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml @@ -13,6 +13,9 @@ rationale: |- severity: medium +conflicts: + - sysctl_kernel_core_pattern_empty_string + identifiers: cce@rhcos4: CCE-82527-3 cce@rhel8: CCE-82215-5 From 62b0e48e7db9ed7e82940d7ca3a34a121f67c6cf Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Tue, 9 Aug 2022 16:43:20 +0200 Subject: [PATCH 8/8] fix ocils --- .../restrictions/sysctl_kernel_core_pattern/rule.yml | 5 ++++- .../restrictions/sysctl_kernel_core_uses_pid/rule.yml | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml index c27a9e7ecf3..1a540ce20b3 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml @@ -29,7 +29,10 @@ references: stigid@ol8: OL08-00-010671 stigid@rhel8: RHEL-08-010671 -ocil_clause: 'the returned line does not have a value of "|/bin/false", or a line is not returned and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement' +ocil_clause: |- + the returned line does not have a value of "|/bin/false", or a line is not + returned and the need for core dumps is not documented with the Information + System Security Officer (ISSO) as an operational requirement ocil: | {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value="|/bin/false") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml index d6d2c468c10..8f51f97c16c 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_uses_pid/rule.yml @@ -24,10 +24,10 @@ identifiers: references: ospp: FMT_SMF_EXT.1 -ocil_clause: 'the returned line does not have a value of 0, or a line is not returned and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement' +ocil_clause: 'the returned line does not have a value of 0' ocil: |- - {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value=0) }}} + {{{ ocil_sysctl_option_value(sysctl="kernel.core_uses_pid", value=0) }}} platform: machine