MediumOS hardeningBLWK-KERNEL-005

Magic SysRq key is fully enabled

What this means

kernel.sysrq exposes dangerous SysRq functions to anyone with keyboard or console access (physical, or a hijacked serial/BMC console). A value of 1 enables every function; a value above 1 is a bitmask, and this fires when that mask still includes the memory-dump bit (0x08, leaks kernel memory) or the signal bit (0x40, SIGKILL any process) — so a widened mask like 510 is caught, not just a plain 1, which the old exact-match condition missed.

How to fix it

Set kernel.sysrq=176 (Ubuntu's restricted default) or 0 via /etc/sysctl.d/ and run sysctl --system.

Check it yourself

Run a scan and look for BLWK-KERNEL-005 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sysctl_kernel and reports this check when:

sysrq == 1 or (sysrq > 1 and sysrq_dump_or_signal == true)

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.5.4

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001