On 7/31/13 2:45 AM, Shawn Wells wrote:
0002-bugfix-Updated-XCCDF-rule-name-of-set_sysctl_ipv6_de.patch
From b6861e6a1b532df8a046e89b9ae721da3d57d84e Mon Sep 17 00:00:00 2001 From: Shawn Wellsshawn@redhat.com Date: Wed, 31 Jul 2013 02:39:45 -0400 Subject: [PATCH 2/2] [bugfix] Updated XCCDF rule name of set_sysctl_ipv6_default_accept_redirects in profiles
On 7/25 the XCCDF rule name of set_sysctl_net_ipv6_default_accept_redirects was changed to set_sysctl_ipv6_default_accept_redirects, however the references within the XCCDF profiles were not updated.
Causing commit: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=b22713b...
BEFORE FIX: [root@rhel6 output]# oscap xccdf eval --profile stig-rhel6-server --results /var/www/html/ssg/results.xml --report /var/www/html/ssg/report.html --cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml . . . OpenSCAP Error: Selector ID(set_sysctl_net_ipv6_default_accept_redirects) does not exist in Benchmark. [xccdf_policy.c:1851]
AFTER FIX: [root@rhel6 output]# oscap xccdf eval --profile stig-rhel6-server --results /var/www/html/ssg/results.xml --report /var/www/html/ssg/report.html --cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml . . . [works]
RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index c06530a..9f67acf 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -90,7 +90,7 @@
<select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/> <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/> <select idref="disable_ipv6_module_loading" selected="true"/> -<select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true"/> +<select idref="set_sysctl_ipv6_default_accept_redirects" selected="true"/> <select idref="service_ip6tables_enabled" selected="true"/> <select idref="service_iptables_enabled" selected="true"/> <select idref="set_iptables_default_rule" selected="true"/> diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index 43a304b..c915028 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -270,7 +270,7 @@ <select idref="disable_ipv6_module_loading" selected="true" /> <select idref="network_ipv6_disable_rpc" selected="true" /> <select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" /> -<select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true" /> +<select idref="set_sysctl_ipv6_default_accept_redirects" selected="true" />
<!-- IA-2(1) -->
<select idref="bootloader_password" selected="true" /> diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index 8050639..796624a 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -302,7 +302,7 @@ assurance."</description> <select idref="disable_ipv6_module_loading" selected="true" \> <select idref="network_ipv6_disable_rpc" selected="true" \> <select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" \> -<select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true" \> +<select idref="set_sysctl_ipv6_default_accept_redirects" selected="true" \> <select idref="network_disable_unused_interfaces" selected="true" \> <select idref="network_disable_zeroconf" selected="true" \> <select idref="network_sniffer_disabled" selected="true" \> diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml index be960fa..2ffad57 100644 --- a/RHEL6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml @@ -151,7 +151,7 @@ <select idref="network_ipv6_disable_rpc" selected="true" /> <refine-value idref="sysctl_net_ipv6_conf_default_accept_ra_value" selector="disabled" /> <select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" /> -<select idref="set_sysctl_net_ipv6_default_accept_redirects" selected="true" /> +<select idref="set_sysctl_ipv6_default_accept_redirects" selected="true" /> <select idref="service_ip6tables_enabled" selected="true" /> <select idref="service_iptables_enabled" selected="true" /> <select idref="set_iptables_default_rule" selected="true" /> -- 1.7.1
bump
scap-security-guide@lists.fedorahosted.org