On 6/29/12 5:45 PM, Willy Santos wrote:
CCI-000032 requires enforcing information flow control using org-defined security policy filters. This mapping is open to discussion and change.
SRG-OS-000016 CCI-000032 The operating system must enforce information flow control using organization-defined security policy filters as a basis for flow control decisions. Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to the information. Organization-defined security policy filters may include, dirty word filters, file type checking filters, structured data filters, unstructured data filters, metadata content filters, and hidden content filters.

It's not practical for the OS to embed such filters into IPTables. Requirement may be legitimate, but not at an OS level. unmet_impractical_product.