dev-sec / dev-sec/linux-baseline

sysctl-17 title/description does not match test

Open
#48 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Ruby
Stars
875
Forks
193
Avg merge
9m
Merged PRs (30d)
1

Description

As per this inline comment[1], there's a mismatch between the title/description and the actual test for systcl-17[2], martian logging.

The title says we're testing to ensure martian logging is disabled, but the actual test verifies that the logging is enabled. If I'm understanding correctly it's possible, even likely, that this is just a simple oversight in commit bb7c532f where the test was updated correctly, but the title/description were missed.

Martian logging enabled matches the chef-os-hardening cookbook behavior[3].

The CIS standards agree martian logging should be enabled. However, the chef BaseOS compliance profile says it should be disabled, perhaps because as the sysctl-17 description states, this logging can create a DoS attack vector.

There's a valid argument to be made either way - enable the logging, or disable it. I don't know which is more correct. Seems like the Chef compliance profile is perhaps the odd man out here, and that logging should be enabled.

[1] https://github.com/dev-sec/linux-baseline/commit/bb7c532f0f20dc88de3cd6e4e54414031b94f7ef#commitcomment-20365340
[2] https://github.com/dev-sec/linux-baseline/blob/bb7c532f0f20dc88de3cd6e4e54414031b94f7ef/controls/sysctl_spec.rb#L186-L193
[3] https://github.com/dev-sec/chef-os-hardening/blob/ea3c8b6634d1c75fa8e84d43b4122cb27293d78f/attributes/sysctl.rb#L124-L126

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the inline comment in commit bb7c532f and the sysctl-17 test in controls/sysctl_spec.rb, then compare the referenced CIS, Chef compliance, and chef-os-hardening expectations. Resolve whether martian logging should be enabled or disabled, and make the test title, description, and assertion consistently reflect that decision.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, ruby
Domain
operating-systems, security, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.