Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

exec-shield incompatible with Oracle Linux UEK #234

Closed
eyespies opened this issue Jan 15, 2019 · 1 comment
Closed

exec-shield incompatible with Oracle Linux UEK #234

eyespies opened this issue Jan 15, 2019 · 1 comment
Labels

Comments

@eyespies
Copy link
Contributor

Describe the bug
Running this cookbook on Oracle Linux with UEK fails. According to the Oracle documentation, this feature (exec-shield) has been removed from UEK, including Oracle Linux 6 and 7. Details are available at https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=282729127294508&id=2334296.1&_afrWindowMode=0&_adf.ctrl-state=aqumhm587_4 for anyone (unfortunately) with an Oracle Linux support login.

Expected behavior
The cookbook should execute without error and

Actual behavior

         * sysctl[kernel.exec-shield] action apply


================================================================================
           Error executing action `apply` on resource 'sysctl[kernel.exec-shield]'
           ================================================================================
           
           Mixlib::ShellOut::ShellCommandFailed
           ------------------------------------
           Expected process to exit with [0], but received '255'
           ---- Begin output of sysctl -w "kernel.exec-shield=1" ----
           STDOUT: 
           STDERR: error: "kernel.exec-shield" is an unknown key
           ---- End output of sysctl -w "kernel.exec-shield=1" ----
           Ran sysctl -w "kernel.exec-shield=1" returned 255
           
           Resource Declaration:
           ---------------------
           # In /tmp/kitchen/cache/cookbooks/os-hardening/recipes/sysctl.rb
           
           133:     sysctl_param k do
           134:       value v
           135:     end
           136:   end
           
           Compiled Resource:
           ------------------
           # Declared in /tmp/kitchen/cache/cookbooks/os-hardening/recipes/sysctl.rb:133:in `block in from_file'
           
           sysctl("kernel.exec-shield") do
             action [:apply]
             default_guard_interpreter :default
             declared_type :sysctl_param
             cookbook_name "os-hardening"
             recipe_name "sysctl"
             value "1"
             key "kernel.exec-shield"
           end
           
           System Info:
           ------------
           chef_version=14.8.12
           platform=oracle
           platform_version=6.10
           ruby=ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-linux]
           program_name=/opt/chef/bin/chef-client
           executable=/opt/chef/bin/chef-client

Example code

include_recipe 'os-hardening'

OS / Environment
Oracle Linux 6 with UEK. It should not affect Oracle Linux 7 since RHEL platform_family has been filtered for < 7 in the existing code.

Chef Version

[vagrant@standalone-server-nfs-oracle-610  ~] :( chef-client --version
Chef: 14.8.12

Cookbook Version

3.1.0

Additional context
I don't think any is required, but will provide anything requested.

artem-sidorenko added a commit that referenced this issue Mar 6, 2019
Do not apply exec-shield if running Oracle Linux with UEK - addresses #234
@artem-sidorenko
Copy link
Member

Resolved via #235

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants