Protection Profile for General Purpose Operating Systems
Rules and Groups employed by this XCCDF Profile
-
Restrict Programs from Dangerous Execution Patterns
The recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution are activated. These protections are applied at the ...Group -
Disable storing core dumps
The <code>kernel.core_pattern</code> option specifies the core dumpfile pattern name. It can be set to an empty string. In this case, the kernel behaves differently based on another related option....Rule Medium Severity -
Configure file name of core dumps
To set the runtime status of the <code>kernel.core_uses_pid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.core_uses_pid=0</pre> To make sure that the setting is p...Rule Medium Severity -
Restrict Access to Kernel Message Buffer
To set the runtime status of the <code>kernel.dmesg_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.dmesg_restrict=1</pre> To make sure that the setting is...Rule Low Severity -
Disable Kernel Image Loading
To set the runtime status of the <code>kernel.kexec_load_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kexec_load_disabled=1</pre> To make sure that the ...Rule Medium Severity -
Disallow kernel profiling by unprivileged users
To set the runtime status of the <code>kernel.perf_event_paranoid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.perf_event_paranoid=2</pre> To make sure that the ...Rule Low Severity -
Disable Access to Network bpf() Syscall From Unprivileged Processes
To prevent unprivileged processes from using the <code>bpf()</code> syscall the <code>kernel.unprivileged_bpf_disabled</code> kernel parameter must be set to <code>1</code> or <code>2</code>. Writ...Rule Medium Severity -
Restrict usage of ptrace to descendant processes
To set the runtime status of the <code>kernel.yama.ptrace_scope</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.yama.ptrace_scope=1</pre> To make sure that the sett...Rule Medium Severity -
Disable the use of user namespaces
To set the runtime status of the <code>user.max_user_namespaces</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w user.max_user_namespaces=0</pre> To make sure that the set...Rule Medium Severity -
Disable Core Dumps
A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases, only software developers legitimately need to acc...Group -
Disable acquiring, saving, and processing core dumps
Thesystemd-coredump.socketunit is a socket activation of thesystemd-coredump@.servicewhich processes core dumps. By masking the unit, core dump processing is disabled.Rule Medium Severity -
Enable ExecShield
ExecShield describes kernel features that provide protection against exploitation of memory corruption errors such as buffer overflows. These features include random placement of the stack and othe...Group -
Restrict Exposed Kernel Pointer Addresses Access
To set the runtime status of the <code>kernel.kptr_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kptr_restrict=<xccdf-1.2:sub idref="xccdf_org.ssgproject...Rule Medium Severity -
SELinux
SELinux is a feature of the Linux kernel which can be used to guard against misconfigured or compromised programs. SELinux enforces the idea that programs should be limited in what files they can a...Group -
Configure SELinux Policy
The SELinux <code>targeted</code> policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct ...Rule Medium Severity -
Ensure SELinux State is Enforcing
The SELinux state should be set to <code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"></xccdf-1.2:sub></code> at system boot time. In the file <code>/et...Rule High Severity -
Services
The best protection against vulnerable software is running less software. This section describes how to review the software which Red Hat Enterprise Linux 9 installs on a system and disable softwar...Group -
Base Services
This section addresses the base services that are installed on a Red Hat Enterprise Linux 9 default installation which are not covered in other sections. Some of these services listen on the networ...Group -
Disable KDump Kernel Crash Analyzer (kdump)
The <code>kdump</code> service provides a kernel crash dump analyzer. It uses the <code>kexec</code> system call to boot a secondary kernel ("capture" kernel) following a system crash, which can lo...Rule Medium Severity -
Application Whitelisting Daemon
Fapolicyd (File Access Policy Daemon) implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applicat...Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Capacity
Modules