diff --git a/docs/templates/template_reference.md b/docs/templates/template_reference.md index 0ffd838659a..bbd71b34dfa 100644 --- a/docs/templates/template_reference.md +++ b/docs/templates/template_reference.md @@ -788,10 +788,20 @@ The selected value can be changed in the profile (consult the actual variable fo ``` #### sysctl -- Checks sysctl parameters. The OVAL definition checks both +- Checks sysctl parameters. The OVAL definition checks both static configuration and runtime settings and require both of them to be set to the desired value to return true. + The following file and directories are checked for static + sysctl configurations: + - /etc/sysctl.conf + - /etc/sysctl.d/\*.conf + - /run/sysctl.d/\*.conf + - /usr/lib/sysctl.d/\*.conf (does not apply to RHEL and OL) + + A sysctl option defined in more than one file within the scanned directories + will result in `fail`. + - Parameters: - **sysctlvar** - name of the sysctl value, eg. diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/wrong_value_run_sysctl_d.fail.sh b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/wrong_value_run_sysctl_d.fail.sh new file mode 100644 index 00000000000..d02cf11f072 --- /dev/null +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/tests/wrong_value_run_sysctl_d.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Clean sysctl config directories +rm -rf /usr/lib/sysctl.d/* /run/sysctl.d/* /etc/sysctl.d/* + +sed -i "/net.ipv4.conf.default.accept_source_route/d" /etc/sysctl.conf +echo "net.ipv4.conf.default.accept_source_route = 1" >> /run/sysctl.d/run.conf +# Setting correct runtime value +sysctl -w net.ipv4.conf.default.accept_source_route=0 diff --git a/shared/templates/sysctl/ansible.template b/shared/templates/sysctl/ansible.template index f525cf873f7..854245ef2a8 100644 --- a/shared/templates/sysctl/ansible.template +++ b/shared/templates/sysctl/ansible.template @@ -6,7 +6,9 @@ - name: List /etc/sysctl.d/*.conf files find: - paths: "/etc/sysctl.d/" + paths: + - "/etc/sysctl.d/" + - "/run/sysctl.d/" contains: '^[\s]*{{{ SYSCTLVAR }}}.*$' patterns: "*.conf" register: find_sysctl_d diff --git a/shared/templates/sysctl/bash.template b/shared/templates/sysctl/bash.template index d68956f4826..e8a16b78285 100644 --- a/shared/templates/sysctl/bash.template +++ b/shared/templates/sysctl/bash.template @@ -5,7 +5,7 @@ # disruption = medium # Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/sysctl.d/*.conf files -for f in /etc/sysctl.d/*.conf ; do +for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do matching_list=$(grep -P '^(?!#).*[\s]*{{{ SYSCTLVAR }}}.*$' $f | uniq ) if ! test -z "$matching_list"; then while IFS= read -r entry; do diff --git a/shared/templates/sysctl/oval.template b/shared/templates/sysctl/oval.template index ba4e65cbaef..92119460186 100644 --- a/shared/templates/sysctl/oval.template +++ b/shared/templates/sysctl/oval.template @@ -111,8 +111,10 @@ test_ref="test_static_etc_sysctld_{{{ SYSCTLID }}}"/> +{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}} +{{% endif %}} @@ -134,11 +136,13 @@ {{{ state_static_sysctld("run_sysctld") }}} +{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}} {{{ state_static_sysctld("usr_lib_sysctld") }}} +{{% endif %}} @@ -238,7 +242,9 @@ object_static_run_sysctld_{{{ SYSCTLID }}} +{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}} object_static_usr_lib_sysctld_{{{ SYSCTLID }}} +{{% endif %}} @@ -259,11 +265,13 @@ {{{ sysctl_match() }}} +{{% if product not in [ "ol7", "ol8", "rhel7", "rhel8", "rhel9"] %}} /usr/lib/sysctl.d ^.*\.conf$ {{{ sysctl_match() }}} +{{% endif %}} {{% if SYSCTLVAL == "" %}}