On 5/13/13 7:32 PM, Jeffrey Blank wrote:
Yes. One of these should go.
We have this, but it states that this sysctl causes "almost all of the
calls into the module" to be disabled.
https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17
So the kernel module option seems stronger. And would suggest we
delete both sysctls. Perhaps somebody from Red Hat engineering can
offer an opinion.
Nice BZ link -- didn't know about the level of integration.
Created
https://fedorahosted.org/scap-security-guide/ticket/408 to track
the creation of XCCDF against the sysctl_net_ipv6_conf_all_disable_ipv6
Anyone want to grab that ticket? Actually, if someone has been thinking
about diving into content creation, I'd be happy to step through the
process with them.