ANSSI-BP-028 (high)
Rules and Groups employed by this XCCDF Profile
-
Disable vsyscall emulate execution only
The kernel traps and emulates calls into the fixed vsyscall address mapping and does not allow reads. This configuration is available from kernel 5...Rule Medium Severity -
Disable the LDT (local descriptor table)
Linux can allow user programs to install a per-process x86 Local Descriptor Table (LDT) using the modify_ldt(2) system call. This is required to ru...Rule Medium Severity -
Enable module signature verification
Check modules for valid signatures upon load. Note that this option adds the OpenSSL development packages as a kernel build dependency so that the ...Rule Medium Severity -
Enable automatic signing of all modules
Sign all modules during make modules_install. Without this option, modules must be signed manually, using the scripts/sign-file tool. The configur...Rule Medium Severity -
Require modules to be validly signed
Reject unsigned modules or signed modules with an unknown key. The configuration that was used to build kernel is available at <code>/boot/config-...Rule Medium Severity -
Specify the hash to use when signing modules
This configures the kernel to build and sign modules using <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_ha...Rule Medium Severity -
Specify module signing key to use
Setting this option to something other than its default of <code>certs/signing_key.pem</code> will disable the autogeneration of signing keys and a...Rule Medium Severity -
Sign kernel modules with SHA-512
This configures the kernel to build and sign modules using SHA512 as the hash function. The configuration that was used to build kernel is availab...Rule Medium Severity -
Enable poison of pages after freeing
Fill the pages with poison patterns after free_pages() and verify the patterns before alloc_pages. This does have a potential performance impact if...Rule Medium Severity -
Enable poison without sanity check
Skip the sanity checking on alloc, only fill the pages with poison on free. This reduces some of the overhead of the poisoning feature. This config...Rule Medium Severity -
Use zero for poisoning instead of debugging value
Instead of using the existing poison value, fill the pages with zeros. This makes it harder to detect when errors are occurring due to sanitization...Rule Medium Severity -
Remove the kernel mapping in user mode
This feature reduces the number of hardware side channels by ensuring that the majority of kernel addresses are not mapped into userspace. This con...Rule High Severity -
Kernel panic oops
Enable the kernel to panic when it oopses. This has the same effect as setting oops=panic on the kernel command line. The configuration that was u...Rule Medium Severity -
Kernel panic timeout
Set the timeout value (in seconds) until a reboot occurs when the kernel panics. A timeout of 0 configures the system to wait forever. With a timeo...Rule Medium Severity -
Disable support for /proc/kkcore
Provides a virtual ELF core file of the live kernel. The configuration that was used to build kernel is available at <code>/boot/config-*</code>. ...Rule Low Severity -
Randomize the address of the kernel image (KASLR)
In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the physical address at which the kernel image is decompressed and...Rule Medium Severity -
Randomize the kernel memory sections
Randomizes the base virtual address of kernel memory sections (physical memory mapping, vmalloc & vmemmap). This configuration is available fro...Rule Medium Severity -
Perform full reference count validation
Enabling this switches the refcounting infrastructure from a fast unchecked atomic_t implementation to a fully state checked implementation, which ...Rule Medium Severity -
Avoid speculative indirect branches in kernel
Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks by avoiding speculative indirect branches. Requires a...Rule Medium Severity -
Detect stack corruption on calls to schedule()
This option checks for a stack overrun on calls to schedule(). If the stack end location is found to be overwritten always panic as the content of ...Rule Medium Severity -
Enable seccomp to safely compute untrusted bytecode
This kernel feature is useful for number crunching applications that may need to compute untrusted bytecode during their execution. By using pipes ...Rule Medium Severity -
Enable use of Berkeley Packet Filter with seccomp
Enable tasks to build secure computing environments defined in terms of Berkeley Packet Filter programs which implement task-defined system call fi...Rule Medium Severity -
Enable different security models
This allows you to choose different security modules to be configured into your kernel. The configuration that was used to build kernel is availab...Rule Medium Severity -
Restrict unprivileged access to the kernel syslog
Enforce restrictions on unprivileged users reading the kernel syslog via dmesg(8). The configuration that was used to build kernel is available at...Rule Medium Severity -
Disable mutable hooks
Ensure kernel structures associated with LSMs are always mapped as read-only after system boot. The configuration that was used to build kernel is...Rule Medium Severity -
Enable Yama support
This enables support for LSM module Yama, which extends DAC support with additional system-wide security settings beyond regular Linux discretionar...Rule Medium Severity -
Harden slab freelist metadata
This feature protects integrity of the allocator's metadata. This configuration is available from kernel 4.14. The configuration that was used to ...Rule Medium Severity -
Randomize slab freelist
Randomizes the freelist order used on creating new pages. This configuration is available from kernel 5.9, but may be available if backported by di...Rule Medium Severity -
Disallow merge of slab caches
For reduced kernel memory fragmentation, slab caches can be merged when they share the same size and other characteristics. This carries a risk of ...Rule Medium Severity -
Enable SLUB debugging support
SLUB has extensive debug support features and this allows the allocator validation checking to be enabled. The configuration that was used to buil...Rule Medium Severity -
Stack Protector buffer overlow detection
This feature puts, at the beginning of functions, a canary value on the stack just before the return address, and validates the value just before a...Rule Medium Severity -
Strong Stack Protector
This features adds canary logic protection to more kinds of vulnerable functions than CONFIG_STACKPROTECTOR, but not to all functions so that perfo...Rule Medium Severity -
Make the kernel text and rodata read-only
When set, kernel text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available fr...Rule Medium Severity -
Make the module text and rodata read-only
When set, module text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available fr...Rule Medium Severity -
Enable TCP/IP syncookie support
Normal TCP/IP networking is open to an attack known as SYN flooding. It is denial-of-service attack that prevents legitimate remote users from bein...Rule Medium Severity -
Unmap kernel when running in userspace (aka KAISER)
Speculation attacks against some high-performance processors can be used to bypass MMU permission checks and leak kernel data to userspace. This ca...Rule Medium Severity -
User a virtually-mapped stack
Enable this to use virtually-mapped kernel stacks with guard pages. This configuration is available from kernel 4.9. The configuration that was us...Rule Medium Severity -
Disable x86 vsyscall emulation
Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also disable the helpful warning if a program tries to use a ...Rule Low Severity -
Kernel GCC plugin configuration
Contains rules that check the configuration of GCC plugins used by the compilerGroup -
Generate some entropy during boot and runtime
Instrument some kernel code to extract some entropy from both original and artificially created program state. This will help especially embedded s...Rule Medium Severity -
Randomize layout of sensitive kernel structures
Randomize at compile-time the layouts of structures that are entirely function pointers (and have not been manually annotated with __no_randomize_l...Rule Medium Severity -
Poison kernel stack before returning from syscalls
This option makes the kernel erase the kernel stack before returning from system calls. This has the effect of leaving the stack initialized to the...Rule Medium Severity -
Force initialization of variables containing userspace addresses
While the kernel is built with warnings enabled for any missed stack variable initializations, this warning is silenced for anything passed by refe...Rule Medium Severity -
zero-init everything passed by reference
Zero-initialize any stack variables that may be passed by reference and had not already been explicitly initialized. This configuration is availabl...Rule Medium Severity -
Configure Syslog
The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...Group -
Ensure rsyslog-gnutls is installed
TLS protocol support for rsyslog is installed. The <code>rsyslog-gnutls</code> package can be installed with the following command: <pre> $ sudo d...Rule Medium Severity -
Ensure Proper Configuration of Log Files
The file <code>/etc/rsyslog.conf</code> controls where log message are written. These are controlled by lines called <i>rules</i>, which consist of...Group -
Ensure Log Files Are Owned By Appropriate Group
The group-owner of all log files written by <code>rsyslog</code> should be <code>root</code>. These log files are determined by the second part of ...Rule Medium Severity -
Ensure Log Files Are Owned By Appropriate User
The owner of all log files written by <code>rsyslog</code> should be <code>root</code>. These log files are determined by the second part of each...Rule Medium Severity -
Ensure System Log Files Have Correct Permissions
The file permissions for all log files written by <code>rsyslog</code> should be set to 640, or more restrictive. These log files are determined by...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.