NAME
Monitoring::Sneck::Checks::sysctl - checks sysctl values
VERSION
Version 0.0.1
SYNOPSIS
!aslr|control=CIS-1.5.3 framework=CIS|perl:sysctl -e kernel.randomize_va_space=2
!no_forwarding||perl:sysctl -e net.ipv4.ip_forward=0 -e net.ipv6.conf.all.forwarding=0
!securelevel||perl:sysctl -e 'kern.securelevel>=1'
!ptrace||perl:sysctl -e 'kernel.yama.ptrace_scope=1|2|3' -mDESCRIPTION
Checks each sysctl given is as wanted. One that is not, or is not there, is CRITICAL, unless --missing-ok is given for those not there.
Each --expect is a name, a comparison, and a value. = and != take values split by |, any of which is enough for =, and none of which may match for !=. <, <=, >, and >= compare as numbers. Values are compared with runs of spaces squashed, as some, such as net.ipv4.ip_local_port_range, have tabs.
On Linux they are read from /proc/sys. A name with a / in it is taken as the path under /proc/sys, for names with dots in parts of them, such as net/ipv4/conf/eth0.100/forwarding. On FreeBSD they are read through BSD::Sysctl. Other OSes are UNKNOWN.
OPTIONS
- -e, --expect :: "name=value", or with !=, <, <=, >, or >=. May be given more than once. Required.
- -m, --missing-ok :: Sysctls that are not there are OK, as for those from a module that is not loaded.
METHODS
check
Does the check.
value
Returns the value of a sysctl with runs of space squashed, or undef if it is not there, or on FreeBSD is a struct BSD::Sysctl can not give as text.