dev-sec / dev-sec/linux-baseline
sysctl-17 title/description does not match test
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 875
- Forks
- 193
- Avg merge
- 9m
- Merged PRs (30d)
- 1
Description
As per this inline comment[1], there's a mismatch between the title/description and the actual test for systcl-17[2], martian logging.
The title says we're testing to ensure martian logging is disabled, but the actual test verifies that the logging is enabled. If I'm understanding correctly it's possible, even likely, that this is just a simple oversight in commit bb7c532f where the test was updated correctly, but the title/description were missed.
Martian logging enabled matches the chef-os-hardening cookbook behavior[3].
The CIS standards agree martian logging should be enabled. However, the chef BaseOS compliance profile says it should be disabled, perhaps because as the sysctl-17 description states, this logging can create a DoS attack vector.
There's a valid argument to be made either way - enable the logging, or disable it. I don't know which is more correct. Seems like the Chef compliance profile is perhaps the odd man out here, and that logging should be enabled.
[1] https://github.com/dev-sec/linux-baseline/commit/bb7c532f0f20dc88de3cd6e4e54414031b94f7ef#commitcomment-20365340
[2] https://github.com/dev-sec/linux-baseline/blob/bb7c532f0f20dc88de3cd6e4e54414031b94f7ef/controls/sysctl_spec.rb#L186-L193
[3] https://github.com/dev-sec/chef-os-hardening/blob/ea3c8b6634d1c75fa8e84d43b4122cb27293d78f/attributes/sysctl.rb#L124-L126
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the inline comment in commit bb7c532f and the sysctl-17 test in controls/sysctl_spec.rb, then compare the referenced CIS, Chef compliance, and chef-os-hardening expectations. Resolve whether martian logging should be enabled or disabled, and make the test title, description, and assertion consistently reflect that decision.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, ruby
- Domain
- operating-systems, security, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100