On 6/29/12 5:45 PM, Willy Santos wrote:
CCI-000032 requires enforcing information flow control using
org-defined security policy filters. This mapping is open to discussion and change.
SRG-OS-000016 CCI-000032 The operating system must enforce information
flow control using organization-defined security policy filters as a
basis for flow control decisions. Information flow control regulates
where information is allowed to travel within an information system and
between information systems (as opposed to who is allowed to access the
information) and without explicit regard to subsequent accesses to the
information. Organization-defined security policy filters may include,
dirty word filters, file type checking filters, structured data filters,
unstructured data filters, metadata content filters, and hidden content
It's not practical for the OS to embed such filters into IPTables.
Requirement may be legitimate, but not at an OS level.