net.ipv6.conf.default.accept_redirects
by Joe Nall
When ipv6 is disabled, net.ipv6.conf.default.accept_redirects is an unknown key.
sysctl net.ipv6.conf.default.accept_redirects
error: "net.ipv6.conf.default.accept_redirects" is an unknown key
because of this, the oval sysctl test associated with sysctl_net_ipv6_conf_default_accept_redirects fails, even when
net.ipv6.conf.default.accept_redirects = 0
is in /etc/sysctl.conf.
Is the right fix to pull this out of create_sysctl_checks.py and write a more complex test using extend_definition like network_ipv6_limit_requests.xml?
joe
11 years, 10 months
set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages
by Joe Nall
Should set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages be set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses since the kernel parameter is net.ipv4.icmp_ignore_bogus_error_responses? Some of the associated prose is incorrect as well.
I'll generate a patch if desired.
joe
11 years, 10 months
ldap_client_tls_checkpeer question
by Joe Nall
There are a number of checks like ldap_client_tls_checkpeer that look for a string or value in a file that are not sensitive to whether the relevant application is installed. What is the preferred way to deal with this problem? I would prefer not to create unused config files just to make a bogus test happy.
Is there a good example in the code of how to test for installation then configuration?
I know I can profile my way around this, but down that path is failures to identify issues when a package is added to a system under management.
joe
11 years, 10 months
[PATCH 0/2] update for obsolete services prose
by Jeffrey Blank
I plan to update and test the base service section next, with a consistent style.
Jeffrey Blank (2):
updated obsolete services section with complete prose * also
removed irrelevant (for RHEL 6) Rules and checks
removed checks for inetd that are inapplicable to RHEL 6 * also
removed unnecessary "hidden" attribute from auxiliary Groups
rhel6/src/input/auxiliary/srg_support.xml | 6 +-
rhel6/src/input/checks/package_inetd_removed.xml | 26 --
rhel6/src/input/checks/service_inetd_disabled.xml | 95 --------
rhel6/src/input/profiles/common.xml | 3 -
rhel6/src/input/services/obsolete.xml | 262 ++++++++++++---------
5 files changed, 155 insertions(+), 237 deletions(-)
delete mode 100644 rhel6/src/input/checks/package_inetd_removed.xml
delete mode 100644 rhel6/src/input/checks/service_inetd_disabled.xml
11 years, 10 months
[PATCH] make Makefile use transform to remove auxiliary Groups
by Jeffrey Blank
This was supposed to have been done originally with the
commit of the auxiliary Group support, but was somehow not included.
As a bugfix, this does not require an ACK.
Jeffrey Blank (1):
made Makefile use transform to remove auxiliary Groups
rhel6/src/Makefile | 12 +++++++-----
1 files changed, 7 insertions(+), 5 deletions(-)
11 years, 10 months