ComplianceAsCode / ComplianceAsCode/content

sysctl_kernel_yama_ptrace_scope should pass with stricter value

Open
#11,217 3 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Apply to the rule `sysctl_kernel_yama_ptrace_scope`

This rule check that `kernel.yama.ptrace_scope=1`, but it is possible to set it to `2` or `3` to have stricter and more secure behavior (REF: [Kernel documentation](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html#ptrace-scope)).

The test should pass with values `1`, `2` or `3`.

#### SCAP Security Guide Version:

Benchmark ID: xccdf_org.ssgproject.content_benchmark_FEDORA
Benchmark version: 0.1.69
Profile ID: xccdf_org.ssgproject.content_profile_ospp

#### Operating System Version:

Fedora 38

#### Steps to Reproduce:

- Run `sudo sysctl -w kernel.yama.ptrace_scope=2`
- Run `oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml`

#### Actual Results:

The rules check FAIL

#### Expected Results:

The rules check PASS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.