ComplianceAsCode / ComplianceAsCode/content
sysctl template
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Share the context
I want to check if sysctl is configured properly:
I have a default config provided by the vendor (```/usr/lib/sysctl.d/...conf```). The values get overwritten by parameters saved in ```/etc/sysctl.d/*.conf```
Currently I get failed test even though the variables that are actually loaded are correct.
#### Description of problem:
The problem begins if e.g. the parameter ```fs.suid_dumpable``` is configured in ```/usr/lib/sysctl.d/``` and then overwritten by ```/etc/sysctl.d/custom.conf```.
Since both files are evaluated this causes (in my opinion) a false positive in the result, because in the end the value, that was loaded last is actually used.
There is no verification what is actually active in memory.
#### Proposed change:
I would propose, that in addition to the file checks, the values that are in memory (```sysctl -a```) also get checked because this finally decides what is active on the system and what not. And if the parameter in memory are correct, the check should pass.
And I already talked to my customer: Simply deleting the files under ```/usr/lib/sysctl.d``` is not an option. Deleting is how I interpreted the tests of the current template.
Contributor guide
Assessment
This issue has not been assessed yet.