On 5/13/13 1:54 PM, Maura Dailey wrote:
The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a
duplicate of
RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since
sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and
formatting of all the other sysctl checks, it seems that
sysctl_net_ipv6_disabled.xml is the one to delete.
Actually, I think they both should be deleted. Neither is being called
from an XCCDF rule:
[shawn@rhel6 input]$ pwd
/var/www/html/scap-security-guide/RHEL6/input
[shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *
checks/sysctl_net_ipv6_disabled.xml:2: <definition class="compliance"
id="sysctl_net_ipv6_disabled" version="1">
[shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_disable_ipv6 *
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:2: <definition
class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6"
version="1">
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:13: <criterion
comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set
to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" />
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:17: <unix:sysctl_test
check="all" check_existence="all_exist" comment="kernel runtime
parameter net.ipv6.conf.all.disable_ipv6 set to 1"
id="test_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:18: <unix:object
object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" />
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:19: <unix:state
state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" />
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:22:
<unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_disable_ipv6"
version="1">
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:26:
<unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6"
version="1">
IIRC, these rules existed before we disabled IPv6 in the kernel &
modprobe via "Disable IPv6 Networking Support Automatic Loading" and
"Disable Interface Usage of IPv6." Is there any reason why we'd also
disable this in sysctl?