[PATCH] Commented out unreferenced check/value.

Shawn Wells shawn at redhat.com
Mon Jul 16 22:21:49 UTC 2012


On 7/16/12 12:35 PM, Michael Palmiotto wrote:
> ---
>   RHEL6/input/profiles/common.xml |    8 ++++++--
>   1 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
> index 1b188da..5a97392 100644
> --- a/RHEL6/input/profiles/common.xml
> +++ b/RHEL6/input/profiles/common.xml
> @@ -59,7 +59,9 @@
>   <select idref="set_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
> -<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" selected="true"/>
> +<!-- Check not referenced in any Rule
> +     <select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" selected="true"/>
> +-->
>   <select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
>   <select idref="set_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
> @@ -223,7 +225,9 @@ these should likely be moved out of common.
>   <!-- net.ipv4.conf.default.secure_redirects -->
>   <refine-value idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled"/>
>   <!-- net.ipv4.icmp_echo_ignore_broadcast -->
> -<refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" selector="enabled"/>
> +<!-- Value not referenced in any Rules
> +	<refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" selector="enabled"/>
> +-->
>   <!-- net.ipv4.icmp_ignore_bogus_error_messages -->
>   <refine-value idref="sysctl_net_ipv4_tcp_syncookies_value" selector="enabled"/>
>   <!-- net.ipv4.tcp_syncookie -->



It's called out on 
scap-security-guide/RHEL6/input/system/network/kernel.xml:295

> <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
> <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
> <description>
> <sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" 
> value="1" />
> </description>
> <rationale>Ignoring bogus ICMP error responses reduces
> log size, although some activity would not be logged.</rationale>
> <ident cce="4133-5" />
> <oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" 
> value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
> <ref nist="AC-3, CM-6, CM-7, SC-5" />
> </Rule>

It's then called out in the "common" XCCDF profile 
scap-security-guide/RHEL6/input/profiles/common.xml via....

selection at scap-security-guide/RHEL6/input/profiles/common.xml:62
> <select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" 
> selected="true"/>

and refinement at scap-security-guide/RHEL6/input/profiles/common.xml:226
> <refine-value 
> idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" 
> selector="enabled"/>


Unless I'm missing something (it happens...), nack


More information about the scap-security-guide mailing list