documentation_complete: true


title: 'Disallow magic SysRq key'

description: '{{{ describe_sysctl_option_value(sysctl="kernel.sysrq", value="0") }}}'

rationale: |-
    The Magic SysRq key allows sending certain commands directly to the running
    kernel. It can dump various system and process information, potentially
    revealing sensitive information. It can also reboot or shutdown the machine,
    disturbing its availability.

severity: medium

identifiers:
    cce@rhel8: CCE-83355-8
    cce@rhel9: CCE-83968-8
    cce@rhel10: CCE-90232-0
    cce@sle12: CCE-91571-0
    cce@sle15: CCE-91261-8

{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.sysrq", value="0") }}}

platform: system_with_kernel

template:
    name: sysctl
    vars:
        sysctlvar: kernel.sysrq
        sysctlval: '0'
        datatype: int
