From 796d3630621847b478896ee4a773cdb605821882 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 18 Aug 2022 13:06:49 +0200 Subject: [PATCH 1/8] Create custom sysctl_kernel_core_pattern_empty_string content. --- .../ansible/shared.yml | 32 +++ .../bash/shared.sh | 60 +++++ .../oval/shared.xml | 221 ++++++++++++++++++ .../rule.yml | 23 +- .../tests/correct_value.pass.sh | 10 + .../tests/wrong_value.fail.sh | 10 + .../tests/wrong_value_three_entries.fail.sh | 11 + .../tests/wrong_value_two_entries.fail.sh | 10 + products/rhel9/profiles/ospp.profile | 2 +- 9 files changed, 366 insertions(+), 13 deletions(-) create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml new file mode 100644 index 00000000000..a6e7bf54b56 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml @@ -0,0 +1,32 @@ +# platform = multi_platform_all +# reboot = true +# strategy = disable +# complexity = low +# disruption = medium +- name: List /etc/sysctl.d/*.conf files + find: + paths: + - /etc/sysctl.d/ + - /run/sysctl.d/ + contains: ^[\s]*kernel.core_pattern.*$ + patterns: '*.conf' + file_type: any + register: find_sysctl_d +- name: Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf + files + replace: + path: '{{ item.path }}' + regexp: ^[\s]*kernel.core_pattern + replace: '#kernel.core_pattern' + loop: '{{ find_sysctl_d.files }}' +- name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf files + replace: + path: /etc/sysctl.conf + regexp: ^[\s]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*\S+ + replace: '#kernel.core_pattern' +- name: Ensure sysctl kernel.core_pattern is set to empty + sysctl: + name: kernel.core_pattern + value: ' ' # ansible sysctl module doesn't allow empty string, a space string is allowed and has the same semantics as sysctl will ignore spaces + state: present + reload: true diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh new file mode 100644 index 00000000000..989987250bc --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh @@ -0,0 +1,60 @@ +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle +# reboot = true +# strategy = disable +# complexity = low +# disruption = medium +# Remediation is applicable only in certain platforms +if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then + +# Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf files + +for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do + + matching_list=$(grep -P '^(?!#).*[\s]*kernel.core_pattern.*$' $f | uniq ) + if ! test -z "$matching_list"; then + while IFS= read -r entry; do + escaped_entry=$(sed -e 's|/|\\/|g' <<< "$entry") + # comment out "kernel.core_pattern" matches to preserve user data + sed -i "s/^${escaped_entry}$/# &/g" $f + done <<< "$matching_list" + fi +done + +# +# Set runtime for kernel.core_pattern +# +/sbin/sysctl -q -n -w kernel.core_pattern="" + +# +# If kernel.core_pattern present in /etc/sysctl.conf, change value to empty +# else, add "kernel.core_pattern =" to /etc/sysctl.conf +# +# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed. +# Otherwise, regular sed command will do. +sed_command=('sed' '-i') +if test -L "/etc/sysctl.conf"; then + sed_command+=('--follow-symlinks') +fi + +# Strip any search characters in the key arg so that the key can be replaced without +# adding any search characters to the config file. +stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^kernel.core_pattern") + +# shellcheck disable=SC2059 +printf -v formatted_output "%s=" "$stripped_key" + +# If the key exists, change it. Otherwise, add it to the config_file. +# We search for the key string followed by a word boundary (matched by \>), +# so if we search for 'setting', 'setting2' won't match. +if LC_ALL=C grep -q -m 1 -i -e "^kernel.core_pattern\\>" "/etc/sysctl.conf"; then + escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output") + "${sed_command[@]}" "s/^kernel.core_pattern\\>.*/$escaped_formatted_output/gi" "/etc/sysctl.conf" +else + # \n is precaution for case where file ends without trailing newline + + printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf" +fi + +else + >&2 echo 'Remediation is not applicable, nothing was done' +fi diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml new file mode 100644 index 00000000000..39654259dcb --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml @@ -0,0 +1,221 @@ + + + + + {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to the appropriate value in both system configuration and system runtime.") }}} + + + + + + + + {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system runtime.") }}} + + + + + + + + + + + + + + kernel.core_pattern + + + + + + + + + + + + + {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system configuration.") }}} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + local_var_sysctl_kernel_core_pattern_empty_string_counter + + + + 1 + + + + + + + + + + + + + object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered + state_sysctl_kernel_core_pattern_empty_string_filepath_is_symlink + + + + + + + + + + + + + + + + + + var_obj_symlink_sysctl_kernel_core_pattern_empty_string + var_obj_blank_sysctl_kernel_core_pattern_empty_string + + + + + local_var_blank_path_sysctl_kernel_core_pattern_empty_string + + + + + + + + local_var_symlinks_sysctl_kernel_core_pattern_empty_string + + + + + + + + + + + + + state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern_empty_string + + + + + ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ + + + + + + + + + + + object_static_etc_sysctls_sysctl_kernel_core_pattern_empty_string + object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string + + + + + + object_static_sysctl_sysctl_kernel_core_pattern_empty_string + object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string + + + + + + object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string + + + + + + /etc/sysctl.conf + ^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$ + 1 + + + + /etc/sysctl.d + ^.*\.conf$ + ^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$ + 1 + + + + /run/sysctl.d + ^.*\.conf$ + ^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$ + 1 + + + + + + + + diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml index dc21f53c98c..2babb28e361 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/rule.yml @@ -1,18 +1,18 @@ documentation_complete: true -prodtype: fedora,ol8,ol9,rhcos4,rhel8,rhel9 +prodtype: rhel9 title: 'Disable storing core dumps' description: |- The kernel.core_pattern option specifies the core dumpfile pattern - name. It can be set to an empty string ''. In this case, the kernel + name. It can be set to an empty string. In this case, the kernel behaves differently based on another related option. If kernel.core_uses_pid is set to 1, then a file named as .PID (where PID is process ID of the crashed process) is created in the working directory. If kernel.core_uses_pid is set to 0, no coredump is saved. - {{{ describe_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}}' + {{{ describe_sysctl_option_value(sysctl="kernel.core_pattern", value="") }}} rationale: |- A core dump includes a memory image taken at the time the operating system @@ -30,17 +30,16 @@ conflicts: identifiers: cce@rhel9: CCE-86005-6 +references: + ospp: FMT_SMF_EXT.1 + ocil_clause: |- - the returned line does not have a value of ''. + the returned line does not have an empty string ocil: | - {{{ ocil_sysctl_option_value(sysctl="kernel.core_pattern", value="''") }}} + The runtime status of the kernel.core_pattern kernel parameter can be queried + by running the following command: + 
$ sysctl kernel.core_pattern | cat -A
+ kernel.core_pattern = $ platform: machine - -template: - name: sysctl - vars: - sysctlvar: kernel.core_pattern - sysctlval: "''" - datatype: string diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh new file mode 100644 index 00000000000..71f0f5db142 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value.pass.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern=" >> /etc/sysctl.conf + +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="" diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh new file mode 100644 index 00000000000..1c5fabcc136 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf + +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="|/bin/false" diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh new file mode 100644 index 00000000000..e56e927ec56 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_three_entries.fail.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf +echo "kernel.core_pattern=" >> /etc/sysctl.conf +echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="" diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh new file mode 100644 index 00000000000..6c065b1e038 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_two_entries.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.conf +echo "kernel.core_pattern=" >> /etc/sysctl.conf +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="" diff --git a/products/rhel9/profiles/ospp.profile b/products/rhel9/profiles/ospp.profile index 9fdd1354e38..b1b18261d48 100644 --- a/products/rhel9/profiles/ospp.profile +++ b/products/rhel9/profiles/ospp.profile @@ -110,7 +110,7 @@ selections: - package_gnutls-utils_installed ### Login - - sysctl_kernel_core_pattern + - sysctl_kernel_core_pattern_empty_string - sysctl_kernel_core_uses_pid - service_systemd-coredump_disabled - var_authselect_profile=minimal From a77abaf442d411fe7bc59e94a1c0330163e03a16 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 11:13:04 +0200 Subject: [PATCH 2/8] Make the conflicts attribute appblicable only to RHEL9. The new rule empty is applicable only to RHEL9 and if there would not be the restriction, then dangling references would be produced. --- .../restrictions/sysctl_kernel_core_pattern/rule.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml index 1a540ce20b3..e369854060b 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml @@ -13,8 +13,10 @@ rationale: |- severity: medium +{{% if product in ["rhel9"] %}} conflicts: - sysctl_kernel_core_pattern_empty_string +{{% endif %}} identifiers: cce@rhcos4: CCE-82527-3 From ec71ac98b89cc8295324c90b1610a5ff01126895 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 11:16:41 +0200 Subject: [PATCH 3/8] Switch bash remediation applicable to all products in sysctl_kernel_core_pattern_empty_string. --- .../sysctl_kernel_core_pattern_empty_string/bash/shared.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh index 989987250bc..9e84d41056d 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_all # reboot = true # strategy = disable # complexity = low From bac544446d3c5a1d87a2b4934cbb94ebc00d2ce9 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 11:23:04 +0200 Subject: [PATCH 4/8] Address feedback. --- .../ansible/shared.yml | 3 +++ .../oval/shared.xml | 19 +++++-------------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml index a6e7bf54b56..22a8d99dae8 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml @@ -12,6 +12,7 @@ patterns: '*.conf' file_type: any register: find_sysctl_d + - name: Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf files replace: @@ -19,11 +20,13 @@ regexp: ^[\s]*kernel.core_pattern replace: '#kernel.core_pattern' loop: '{{ find_sysctl_d.files }}' + - name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf files replace: path: /etc/sysctl.conf regexp: ^[\s]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*\S+ replace: '#kernel.core_pattern' + - name: Ensure sysctl kernel.core_pattern is set to empty sysctl: name: kernel.core_pattern diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml index 39654259dcb..1c3bbfd9a3e 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/oval/shared.xml @@ -10,7 +10,9 @@ definition_ref="sysctl_kernel_core_pattern_empty_string_runtime"/> - + + + {{{ oval_metadata("The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system runtime.") }}} @@ -23,21 +25,15 @@ comment="kernel runtime parameter kernel.core_pattern set to an empty string" check="all" check_existence="all_exist" state_operator="OR"> - - kernel.core_pattern - - - - + @@ -53,18 +49,17 @@ test_ref="test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld"/> - + - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - @@ -189,7 +183,6 @@ object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string - @@ -213,9 +206,7 @@ 1 - - From 39bb8e75c95c469a4f6428664f24f7f9688ffa87 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 14:46:15 +0200 Subject: [PATCH 5/8] Fix test parse affected to support OVAL with multiple def-group tags. --- tests/test_parse_affected.py | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/tests/test_parse_affected.py b/tests/test_parse_affected.py index 8407794b972..947b56636c0 100755 --- a/tests/test_parse_affected.py +++ b/tests/test_parse_affected.py @@ -3,6 +3,7 @@ from __future__ import print_function import os +import re import sys import ssg.constants @@ -73,19 +74,24 @@ def parse_affected(cur_dir, env_yaml): if not xml_content: continue - oval_contents = ssg.utils.split_string_content(xml_content) + # split multiple def group into a list so multiple definitions in one OVAL also work + # this findall does not preserv the tag but it's not necessary for the + # purpose of the test + xml_content_list = re.findall(r'(.+?)', xml_content, re.DOTALL) + for item in xml_content_list: + oval_contents = ssg.utils.split_string_content(item) - try: - results = ssg.oval.parse_affected(oval_contents) + try: + results = ssg.oval.parse_affected(oval_contents) - assert len(results) == 3 - assert isinstance(results[0], int) - assert isinstance(results[1], int) + assert len(results) == 3 + assert isinstance(results[0], int) + assert isinstance(results[1], int) - except ValueError as e: - print("No element found in file {}. " - " Parsed XML was:\n{}".format(oval, xml_content)) - raise e + except ValueError as e: + print("No element found in file {}. " + " Parsed XML was:\n{}".format(oval, item)) + raise e if __name__ == "__main__": From 8d6176c1f96f983aaa0134d19cc66fd3c7b29e15 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 15:14:57 +0200 Subject: [PATCH 6/8] Fix ansible remediation to preserve old non compliant values. Comment out any offending line. --- .../ansible/shared.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml index 22a8d99dae8..f4dc5110fee 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/ansible/shared.yml @@ -24,8 +24,8 @@ - name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf files replace: path: /etc/sysctl.conf - regexp: ^[\s]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*\S+ - replace: '#kernel.core_pattern' + regexp: '^[\s]*kernel.core_pattern([ \t]*=[ \t]*\S+)' + replace: '#kernel.core_pattern\1' - name: Ensure sysctl kernel.core_pattern is set to empty sysctl: From c5bcea37000f54f3273d529237e02fe0979e6d6d Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 15:20:41 +0200 Subject: [PATCH 7/8] Fix PEP8 issue. --- tests/test_parse_affected.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_parse_affected.py b/tests/test_parse_affected.py index 947b56636c0..53690df5ce1 100755 --- a/tests/test_parse_affected.py +++ b/tests/test_parse_affected.py @@ -90,7 +90,7 @@ def parse_affected(cur_dir, env_yaml): except ValueError as e: print("No element found in file {}. " - " Parsed XML was:\n{}".format(oval, item)) + " Parsed XML was:\n{}".format(oval, item)) raise e From 243347ad56fcd4f83f0b77e9b3b7fcd98d0d4acb Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 25 Aug 2022 16:31:31 +0200 Subject: [PATCH 8/8] Add more test scenarios for sysctl_kernel_core_pattern_empty_string. --- .../tests/correct_value_with_spaces.pass.sh | 10 ++++++++++ .../tests/wrong_value_d_directory.fail.sh | 9 +++++++++ .../tests/wrong_value_runtime.fail.sh | 10 ++++++++++ 3 files changed, 29 insertions(+) create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh new file mode 100644 index 00000000000..b6688e6ca91 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/correct_value_with_spaces.pass.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern= " >> /etc/sysctl.conf + +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="" diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh new file mode 100644 index 00000000000..6c574b92762 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_d_directory.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.d/98-sysctl.conf + +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="" diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh new file mode 100644 index 00000000000..8c729677b86 --- /dev/null +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern_empty_string/tests/wrong_value_runtime.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/kernel.core_pattern/d" /etc/sysctl.conf +echo "kernel.core_pattern=" >> /etc/sysctl.conf + +# set correct runtime value to check if the filesystem configuration is evaluated properly +sysctl -w kernel.core_pattern="|/bin/false"