From shawn at redhat.com Thu Aug 20 11:31:39 2015 Content-Type: multipart/mixed; boundary="===============7548700943896162705==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Commented out unreferenced check/value. Date: Mon, 16 Jul 2012 20:12:29 -0400 Message-ID: <5004ADED.2020409@redhat.com> In-Reply-To: 30EF6B99D744684DBB7C1A3DD5C645ED6EEF42@Exchange10.columbia.tresys.com --===============7548700943896162705== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/16/12 7:22 PM, Michael Palmiotto wrote: >>> + >>> + >>> It's called out on >>> scap-security-guide/RHEL6/input/system/network/kernel.xml:295 >> Consider me totally out of the loop at this point, and transforms might >> address this, but isn't this snippet for a different ID? >> Thanks >> --Spencer > I think you're actually both right and the blame lies in my court. > Shawn was probably looking at the patch cover letter, while Spencer was > looking at the diff. > > Let me clear this up. The cover letter for my patch reflects the wrong > idref (ie bogus_error_responses rather than bogus_error_messages). > It was intended to say, "[PATCH] Commented out unreferenced > sysctl_net_ipv4_icmp_ignore_bogus_error_messages check/value." > > I am still not seeing the bogus_error_messages check/value being > referenced in any Rules. > > My apologies for the confusion. Actually, looks like you found something much more fun. [shawn(a)rhel6 input]$ grep -rni "set_sysctl_net_ipv4_icmp_ignore_bogus" * profiles/common.xml:62: selected=3D"true"/> .... this really should be "...bogus_error_responses" And then we have = checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml, which = should be deleted. I'll make a quick patch for this. --===============7548700943896162705==--