Oh, so also, ACK to Maura's patch. We're only debating about how much
further to go, not debating its merits.
On Mon, May 13, 2013 at 7:32 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil>wrote:
Yes. One of these should go.
We have this, but it states that this sysctl causes "almost all of the
calls into the module" to be disabled.
https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17
So the kernel module option seems stronger. And would suggest we delete
both sysctls. Perhaps somebody from Red Hat engineering can offer an
opinion.
On Mon, May 13, 2013 at 3:50 PM, Shawn Wells <shawn(a)redhat.com> wrote:
> On 5/13/13 3:43 PM, Maura Dailey wrote:
>
>> On 05/13/2013 03:24 PM, Shawn Wells wrote:
>>
>>> On 5/13/13 1:54 PM, Maura Dailey wrote:
>>>
>>>> The check RHEL6/input/checks/sysctl_net_**ipv6_disabled.xml is a
>>>> duplicate of RHEL6/input/checks/sysctl_net_**
>>>> ipv6_conf_all_disable_ipv6.**xml. Since
sysctl_net_ipv6_conf_all_**disable_ipv6.xml
>>>> matches the type and formatting of all the other sysctl checks, it seems
>>>> that sysctl_net_ipv6_disabled.xml is the one to delete.
>>>>
>>>
>>>
>>> Actually, I think they both should be deleted. Neither is being called
>>> from an XCCDF rule:
>>>
>>>> [shawn@rhel6 input]$ pwd
>>>> /var/www/html/scap-security-**guide/RHEL6/input
>>>>
>>>> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *
>>>> checks/sysctl_net_ipv6_**disabled.xml:2: <definition
>>>> class="compliance" id="sysctl_net_ipv6_disabled"
version="1">
>>>>
>>>> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_**disable_ipv6
>>>> *
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:2: <definition
>>>> class="compliance"
id="sysctl_net_ipv6_conf_all_**disable_ipv6"
>>>> version="1">
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:13: <criterion
>>>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set
to 1"
>>>> test_ref="test_sysctl_net_**ipv6_conf_all_disable_ipv6" />
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:17:
>>>> <unix:sysctl_test check="all"
check_existence="all_exist" comment="kernel
>>>> runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1"
>>>> id="test_sysctl_net_ipv6_conf_**all_disable_ipv6"
version="1">
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:18: <unix:object
>>>> object_ref="object_sysctl_net_**ipv6_conf_all_disable_ipv6"
/>
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:19: <unix:state
>>>> state_ref="state_sysctl_net_**ipv6_conf_all_disable_ipv6"
/>
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:22:
>>>> <unix:sysctl_object
id="object_sysctl_net_ipv6_**conf_all_disable_ipv6"
>>>> version="1">
>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:26:
>>>> <unix:sysctl_state
id="state_sysctl_net_ipv6_**conf_all_disable_ipv6"
>>>> version="1">
>>>>
>>>
>>> IIRC, these rules existed before we disabled IPv6 in the kernel &
>>> modprobe via "Disable IPv6 Networking Support Automatic Loading"
and
>>> "Disable Interface Usage of IPv6." Is there any reason why we'd
also
>>> disable this in sysctl?
>>>
>>
>> That thought also occurred to me. I'd think that the only reason to
>> check for both is if both achieve the same effect equally well (in which
>> case, the checks should probably be combined in an OR), or if we
>> specifically wanted to give users that used sysctl checks from previous
>> security guidance to get a pass.
>>
>
> Other rules already exist to disable IPv6 at the kernel and module
> levels. There seems little value to duplicate this through yet another
> sysctl check.
>
> Anyone from the community have opinions?
>
>
> ______________________________**_________________
> scap-security-guide mailing list
>
scap-security-guide@lists.**fedorahosted.org<scap-security-guide(a)lists.fedorahosted.org>
>
https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide&l...
>