On 5/13/13 7:32 PM, Jeffrey Blank wrote:
Yes. One of these should go.

We have this, but it states that this sysctl causes "almost all of the calls into the module" to be disabled.
https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17

So the kernel module option seems stronger.  And would suggest we delete both sysctls.  Perhaps somebody from Red Hat engineering can offer an opinion.


Nice BZ link -- didn't know about the level of integration.

Created https://fedorahosted.org/scap-security-guide/ticket/408 to track the creation of XCCDF against the sysctl_net_ipv6_conf_all_disable_ipv6

Anyone want to grab that ticket? Actually, if someone has been thinking about diving into content creation, I'd be happy to step through the process with them.