sysctl-17 title/description does not match test
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- linux, ruby
- Domain
- operating-systems, security, testing-qa
Research direction
Start by reading the inline comment in commit bb7c532f and the sysctl-17 test in controls/sysctl_spec.rb, then compare the referenced CIS, Chef compliance, and chef-os-hardening expectations. Resolve whether martian logging should be enabled or disabled, and make the test title, description, and assertion consistently reflect that decision.
Written by the indexing model from the issue text.
Description
As per this inline comment[1], there's a mismatch between the title/description and the actual test for systcl-17[2], martian logging.
The title says we're testing to ensure martian logging is disabled, but the actual test verifies that the logging is enabled. If I'm understanding correctly it's possible, even likely, that this is just a simple oversight in commit bb7c532f where the test was updated correctly, but the title/description were missed.
Martian logging enabled matches the chef-os-hardening cookbook behavior[3].
The CIS standards agree martian logging should be enabled. However, the chef BaseOS compliance profile says it should be disabled, perhaps because as the sysctl-17 description states, this logging can create a DoS attack vector.
There's a valid argument to be made either way - enable the logging, or disable it. I don't know which is more correct. Seems like the Chef compliance profile is perhaps the odd man out here, and that logging should be enabled.
[1] https://github.com/dev-sec/linux-baseline/commit/bb7c532f0f20dc88de3cd6e4e54414031b94f7ef#commitcomment-20365340
[2] https://github.com/dev-sec/linux-baseline/blob/bb7c532f0f20dc88de3cd6e4e54414031b94f7ef/controls/sysctl_spec.rb#L186-L193
[3] https://github.com/dev-sec/chef-os-hardening/blob/ea3c8b6634d1c75fa8e84d43b4122cb27293d78f/attributes/sysctl.rb#L124-L126
- Dominant language
- Ruby
- Stars
- 875
- Forks
- 193
- Avg merge
- 9m
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dev-sec/linux-baseline
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 48/100
dev-sec/linux-baseline#191 · 2 comments ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 58/100
dev-sec/linux-baseline#188 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 48/100
dev-sec/linux-baseline#173 · 6 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
dev-sec/linux-baseline#161 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
dev-sec/linux-baseline#140 · 7 comments · 5 reactions ·
All issues in dev-sec/linux-baseline
Similar issues
-
user-reported
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Kong/developer.konghq.com#7316 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TheOdinProject/curriculum#31408 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
bensheldon/good_job#1816 · 5 comments ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
notch8/utk_knapsack#148 ·