ComplianceAsCode / ComplianceAsCode/content

sysctl template

Open
#10,203 3 comments 0 reactions 0 assignees View on GitHub
enhancement triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Share the context

I want to check if sysctl is configured properly:

I have a default config provided by the vendor (```/usr/lib/sysctl.d/...conf```). The values get overwritten by parameters saved in ```/etc/sysctl.d/*.conf```

Currently I get failed test even though the variables that are actually loaded are correct.

#### Description of problem:

The problem begins if e.g. the parameter ```fs.suid_dumpable``` is configured in ```/usr/lib/sysctl.d/``` and then overwritten by ```/etc/sysctl.d/custom.conf```.

Since both files are evaluated this causes (in my opinion) a false positive in the result, because in the end the value, that was loaded last is actually used.

There is no verification what is actually active in memory.

#### Proposed change:

I would propose, that in addition to the file checks, the values that are in memory (```sysctl -a```) also get checked because this finally decides what is active on the system and what not. And if the parameter in memory are correct, the check should pass.

And I already talked to my customer: Simply deleting the files under ```/usr/lib/sysctl.d``` is not an option. Deleting is how I interpreted the tests of the current template.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.