When ipv6 is disabled, net.ipv6.conf.default.accept_redirects is an unknown key.
error: "net.ipv6.conf.default.accept_redirects" is an unknown key
because of this, the oval sysctl test associated with sysctl_net_ipv6_conf_default_accept_redirects fails, even when
net.ipv6.conf.default.accept_redirects = 0
is in /etc/sysctl.conf.
Is the right fix to pull this out of create_sysctl_checks.py and write a more complex test using extend_definition like network_ipv6_limit_requests.xml?
Should set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages be set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses since the kernel parameter is net.ipv4.icmp_ignore_bogus_error_responses? Some of the associated prose is incorrect as well.
I'll generate a patch if desired.
There are a number of checks like ldap_client_tls_checkpeer that look for a string or value in a file that are not sensitive to whether the relevant application is installed. What is the preferred way to deal with this problem? I would prefer not to create unused config files just to make a bogus test happy.
Is there a good example in the code of how to test for installation then configuration?
I know I can profile my way around this, but down that path is failures to identify issues when a package is added to a system under management.
I plan to update and test the base service section next, with a consistent style.
Jeffrey Blank (2):
updated obsolete services section with complete prose * also
removed irrelevant (for RHEL 6) Rules and checks
removed checks for inetd that are inapplicable to RHEL 6 * also
removed unnecessary "hidden" attribute from auxiliary Groups
rhel6/src/input/auxiliary/srg_support.xml | 6 +-
rhel6/src/input/checks/package_inetd_removed.xml | 26 --
rhel6/src/input/checks/service_inetd_disabled.xml | 95 --------
rhel6/src/input/profiles/common.xml | 3 -
rhel6/src/input/services/obsolete.xml | 262 ++++++++++++---------
5 files changed, 155 insertions(+), 237 deletions(-)
delete mode 100644 rhel6/src/input/checks/package_inetd_removed.xml
delete mode 100644 rhel6/src/input/checks/service_inetd_disabled.xml
This was supposed to have been done originally with the
commit of the auxiliary Group support, but was somehow not included.
As a bugfix, this does not require an ACK.
Jeffrey Blank (1):
made Makefile use transform to remove auxiliary Groups
rhel6/src/Makefile | 12 +++++++-----
1 files changed, 7 insertions(+), 5 deletions(-)