Detections
Analytics
1.5.4 Ensure kernel.dmesg_restrict is configured
Information
kernel.dmesg_restrict can be used to configure the Linux kernel and prevent unprivileged users access to information from the kernel's log buffer.More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.
Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a non-privileged user.
Solution
- Review all files being used by systemd sysctl and comment out or remove all kernel.dmesg_restrict lines that are not kernel.dmesg_restrict=1.Example script:
#!/usr/bin/env bash
{
l_option="kernel.dmesg_restrict" l_value="1"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(0|[2-9]|1[0-9]+)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
kernel.dmesg_restrict = 1
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "kernel.dmesg_restrict = 1" >> /etc/sysctl.d/60-kernel_sysctl.conf
- Run the following command to load all system configuration files:
# sysctl --system
Impact:
Setting kernel.dmesg_restrict to 1 restricts access to the kernel message buffer ( dmesg ) to users holding the CAP_SYSLOG capability; unprivileged users can no longer read it.
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-2, CSCv7|14.6
Plugin: Unix
Control ID: 86c435a748f2f1e913ec6897bcaf117317542f1f82b177906de13b7e865edd0a