Ubuntu OS must restrict access to the kernel message buffer.

Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a nonprivileged user.

Verify Ubuntu OS is configured to restrict access to the kernel message buffer by using the following command:

     $ sysctl kernel.dmesg_restrict 
     kernel.dmesg_restrict = 1 

If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.

Verify there are no configurations that enable the kernel dmesg function:

     $ sudo grep -ir kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null 
     /etc/sysctl.d/10-kernel-hardening.conf:kernel.dmesg_restrict = 1 

If "kernel.dmesg_restrict" is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Configure Ubuntu OS to restrict access to the kernel message buffer.

Add or modify the following line in the "/etc/sysctl.conf" file:

kernel.dmesg_restrict = 1

Remove any configurations that conflict with the above from the following locations:

/run/sysctl.d/ /etc/sysctl.d/ /usr/local/lib/sysctl.d/ /usr/lib/sysctl.d/ /lib/sysctl.d/ /etc/sysctl.conf

Reload settings from all system configuration files by using the following command:

     $ sudo sysctl --system

Note: This is set by default as part of the NetIM Ubuntu baseline.