STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

RHEL 8 must prevent kernel profiling by unprivileged users.

DISA Rule

SV-230270r627750_rule

Vulnerability Number

V-230270

Group Title

SRG-OS-000138-GPOS-00069

Rule Version

RHEL-08-010376

Severity

CAT III

CCI(s)

• CCI-001090 - The information system prevents unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

Configure the operating system to prevent kernel profiling by unprivileged users.

Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory:

kernel.perf_event_paranoid = 2

Load settings from all system configuration files with the following command:

$ sudo sysctl --system

Check Contents

Verify the operating system is configured to prevent kernel profiling by unprivileged users with the following commands:

Check the status of the kernel.perf_event_paranoid kernel parameter.

$ sudo sysctl kernel.perf_event_paranoid

kernel.perf_event_paranoid = 2

If "kernel.perf_event_paranoid" is not set to "2" or is missing, this is a finding.

Check that the configuration files are present to enable this kernel parameter.

$ sudo grep -r kernel.perf_event_paranoid /etc/sysctl.conf /etc/sysctl.d/*.conf

/etc/sysctl.d/99-sysctl.conf:kernel.perf_event_paranoid = 2

If "kernel.perf_event_paranoid" is not set to "2", is missing or commented out, this is a finding.

Vulnerability Number

V-230270

Documentable

False

Rule Version

RHEL-08-010376

Severity Override Guidance

Verify the operating system is configured to prevent kernel profiling by unprivileged users with the following commands:

Check the status of the kernel.perf_event_paranoid kernel parameter.

$ sudo sysctl kernel.perf_event_paranoid

kernel.perf_event_paranoid = 2

If "kernel.perf_event_paranoid" is not set to "2" or is missing, this is a finding.

Check that the configuration files are present to enable this kernel parameter.

$ sudo grep -r kernel.perf_event_paranoid /etc/sysctl.conf /etc/sysctl.d/*.conf

/etc/sysctl.d/99-sysctl.conf:kernel.perf_event_paranoid = 2

If "kernel.perf_event_paranoid" is not set to "2", is missing or commented out, this is a finding.

Check Content Reference

M

Target Key

2921

Comments