On 5/13/13 3:43 PM, Maura Dailey wrote:
On 05/13/2013 03:24 PM, Shawn Wells wrote:
> On 5/13/13 1:54 PM, Maura Dailey wrote:
>> The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a
>> duplicate of
>> RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since
>> sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and
>> formatting of all the other sysctl checks, it seems that
>> sysctl_net_ipv6_disabled.xml is the one to delete.
>
>
> Actually, I think they both should be deleted. Neither is being
> called from an XCCDF rule:
>> [shawn@rhel6 input]$ pwd
>> /var/www/html/scap-security-guide/RHEL6/input
>>
>> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *
>> checks/sysctl_net_ipv6_disabled.xml:2: <definition
>> class="compliance" id="sysctl_net_ipv6_disabled"
version="1">
>>
>> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_disable_ipv6 *
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:2: <definition
>> class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6"
>> version="1">
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:13: <criterion
>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set
>> to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" />
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:17:
>> <unix:sysctl_test check="all" check_existence="all_exist"
>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set
>> to 1" id="test_sysctl_net_ipv6_conf_all_disable_ipv6"
version="1">
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:18: <unix:object
>> object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" />
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:19: <unix:state
>> state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" />
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:22:
>> <unix:sysctl_object
>> id="object_sysctl_net_ipv6_conf_all_disable_ipv6"
version="1">
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:26:
>> <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6"
>> version="1">
>
> IIRC, these rules existed before we disabled IPv6 in the kernel &
> modprobe via "Disable IPv6 Networking Support Automatic Loading" and
> "Disable Interface Usage of IPv6." Is there any reason why we'd also
> disable this in sysctl?
That thought also occurred to me. I'd think that the only reason to
check for both is if both achieve the same effect equally well (in
which case, the checks should probably be combined in an OR), or if we
specifically wanted to give users that used sysctl checks from
previous security guidance to get a pass.
Other rules already exist to disable IPv6 at the kernel and module
levels. There seems little value to duplicate this through yet another
sysctl check.
Anyone from the community have opinions?