-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Turn off remedations for /dev/shm
#11364
Turn off remedations for /dev/shm
#11364
Conversation
Both the Blueprint and Anaconda are not applicable on modern Linux OSs.
Since this should be tmpfs and this making IB builds fail these rules' blueprint remediation has been disabled.
182e5b9
to
490f4c0
Compare
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_partition_for_dev_shm'.
--- xccdf_org.ssgproject.content_rule_partition_for_dev_shm
+++ xccdf_org.ssgproject.content_rule_partition_for_dev_shm
@@ -3,19 +3,23 @@
Ensure /dev/shm is configured
[description]:
-The /dev/shm is a traditional shared memory concept.
-One program will create a memory portion, which other processes
-(if permitted) can access. If /dev/shm is not configured,
+The /dev/shm is a traditional shared memory concept.
+One program will create a memory portion, which other processes
+(if permitted) can access. If /dev/shm is not configured,
tmpfs will be mounted to /dev/shm by systemd.
+[warning]:
+This rule does not have a remedation.
+It is expected that this will be managed by systemd and will be a tmpfs partition.
+
[rationale]:
-Any user can upload and execute files inside the /dev/shm similar to
-the /tmp partition. Configuring /dev/shm allows an administrator
-to set the noexec option on the mount, making /dev/shm useless for an attacker to
-install executable code. It would also prevent an attacker from establishing a
-hardlink to a system setuid program and wait for it to be updated. Once the program
-was updated, the hardlink would be broken and the attacker would have his own copy
-of the program. If the program happened to have a security vulnerability, the attacker
+Any user can upload and execute files inside the /dev/shm similar to
+the /tmp partition. Configuring /dev/shm allows an administrator
+to set the noexec option on the mount, making /dev/shm useless for an attacker to
+install executable code. It would also prevent an attacker from establishing a
+hardlink to a system setuid program and wait for it to be updated. Once the program
+was updated, the hardlink would be broken and the attacker would have his own copy
+of the program. If the program happened to have a security vulnerability, the attacker
could continue to exploit the known flaw.
[ident]:
New data stream is missing blueprint remediation for rule 'xccdf_org.ssgproject.content_rule_partition_for_dev_shm'.
New data stream is missing anaconda remediation for rule 'xccdf_org.ssgproject.content_rule_partition_for_dev_shm'. |
Code Climate has analyzed commit 490f4c0 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5%. View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Description:
mount_option_dev_shm_noexec
mount_option_dev_shm_*
Rationale:
Fixes #11344
Fixes RHEL-16801 and RHEL-17386
It should be fine since default this will be tmpfs partition managed by systemd.