Detections
Analytics
1.5.8 Ensure kernel.kptr_restrict is configured
Information
kernel.kptr_restrict sets whether restrictions are placed on exposing kernel addresses via /proc and other interfaces.- kptr_restrict = 0 - The address is hashed before printing. (equivalent to %p.)
- kptr_restrict = 1 - kernel pointers printed using the %pK format specifier will be replaced with 0 's.
- kptr_restrict = 2 - kernel pointers printed using %pK will be replaced with 0 's regardless of privileges.
More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.
Masking the kernel symbols in /proc/kallsyms reduces the ability of an attacker using them to learn more about what to attack on your system.
Solution
- Review all files being used by systemd-sysctl and comment out or remove all kernel.kptr_restrict lines that are not kernel.kptr_restrict=1 or kernel.kptr_restrict=2.Example script:
#!/usr/bin/env bash
{
l_option="kernel.kptr_restrict" l_value="(1|2)"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
l_ufw_file="$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
[ -f "$(readlink -e "$l_ufw_file")" ] && \
a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Pios '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Pios '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Pivq '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(0|[3-9]|[1-9][0-9]+)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
kernel.kptr_restrict = {N}
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "kernel.kptr_restrict = 2" >> /etc/sysctl.d/60-kernel_sysctl.conf
Note: The example uses kernel.kptr_restrict = 2 but value may be set to 1 or 2
- Run the following command to load all system configuration files:
# sysctl --system
Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.
See Also
Item Details
Audit Name: CIS Debian Linux 13 v1.1.0 L1 Server
Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT
References: 800-53|AU-4, 800-53|CM-6b., CSCv7|4.8, CSCv7|9.2
Plugin: Unix
Control ID: 74cde2ab12b1c96daed4648911643b24cf487766fd1c79e0329a7bd14bb919b7