projects
/
kconfig-hardened-check.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
709a822
)
Add the 'fs.suid_dumpable' check
author
Alexander Popov
<alex.popov@linux.com>
Tue, 17 Oct 2023 16:24:25 +0000
(19:24 +0300)
committer
Alexander Popov
<alex.popov@linux.com>
Tue, 17 Oct 2023 16:24:25 +0000
(19:24 +0300)
kernel_hardening_checker/checks.py
patch
|
blob
|
history
diff --git
a/kernel_hardening_checker/checks.py
b/kernel_hardening_checker/checks.py
index 8e754c02ceabed5b37fe7396456f03a29e6ff198..ca829a3d857b19f3f4fca918195b38cad4b385bb 100644
(file)
--- a/
kernel_hardening_checker/checks.py
+++ b/
kernel_hardening_checker/checks.py
@@
-580,7
+580,6
@@
def normalize_cmdline_options(option, value):
# TODO: draft of security hardening sysctls:
# what about bpf_jit_enable?
# vm.mmap_min_addr has a good value
# TODO: draft of security hardening sysctls:
# what about bpf_jit_enable?
# vm.mmap_min_addr has a good value
-# fs.suid_dumpable=0
# kernel.modules_disabled=1
# kernel.randomize_va_space=2
# nosmt sysfs control file
# kernel.modules_disabled=1
# kernel.randomize_va_space=2
# nosmt sysfs control file
@@
-616,3
+615,4
@@
def add_sysctl_checks(l, arch):
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_hardlinks', '1')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_fifos', '2')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_regular', '2')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_hardlinks', '1')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_fifos', '2')]
l += [SysctlCheck('harden_userspace', 'kspp', 'fs.protected_regular', '2')]
+ l += [SysctlCheck('harden_userspace', 'kspp', 'fs.suid_dumpable', '0')]