Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kernel.perf_event_paranoid should pass for values >= 3 #1376

Closed
micchickenburger opened this issue Mar 9, 2023 · 3 comments · Fixed by #1377
Closed

kernel.perf_event_paranoid should pass for values >= 3 #1376

micchickenburger opened this issue Mar 9, 2023 · 3 comments · Fixed by #1377
Assignees

Comments

@micchickenburger
Copy link

Describe the bug
kernel.perf_event_paranoid in the Kernel hardening "Comparing sysctl key pairs with scan profiles" stage expects a value of 3 in a default configuration. It seems that It should instead expect a value >= 3, since Ubuntu Jammy defaults to 4.

See here for more information: https://askubuntu.com/questions/1400874/what-does-perf-paranoia-level-four-do

Version

  • Distribution: Ubuntu Server 22.04 arm64
  • Lynis 3.0.8-100

Expected behavior
I expect a value greater than or equal to 3 to pass.

Output

$ sudo lynis audit system
# ...
[+] Kernel Hardening
------------------------------------
  - Comparing sysctl key pairs with scan profile
    - kernel.perf_event_paranoid (exp: 3)                     [ DIFFERENT ]
# ...

$ sudo sysctl kernel.perf_event_paranoid
kernel.perf_event_paranoid = 4

$ uname -a
Linux ip-172-31-18-30 5.15.0-1028-aws #32-Ubuntu SMP Mon Jan 9 12:29:05 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
@konstruktoid
Copy link
Contributor

Hi @micchickenburger, can you try #1377

@micchickenburger
Copy link
Author

Yes, this works great. Thanks!

@mboelen
Copy link
Member

mboelen commented May 14, 2024

Related PR was merged, so should be resolved now (in next release).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants