[PATCH] Commented out unreferenced check/value.

Spencer R. Shimko sshimko at tresys.com
Mon Jul 16 22:48:44 UTC 2012


On 7/16/12 6:21 PM, "Shawn Wells" <shawn at redhat.com> wrote:

>On 7/16/12 12:35 PM, Michael Palmiotto wrote:
>> ---
>>   RHEL6/input/profiles/common.xml |    8 ++++++--
>>   1 files changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/RHEL6/input/profiles/common.xml
>>b/RHEL6/input/profiles/common.xml
>> index 1b188da..5a97392 100644
>> --- a/RHEL6/input/profiles/common.xml
>> +++ b/RHEL6/input/profiles/common.xml
>> @@ -59,7 +59,9 @@
>>   <select idref="set_sysctl_net_ipv4_conf_default_accept_source_route"
>>selected="true"/>
>>   <select idref="set_sysctl_net_ipv4_conf_default_secure_redirects"
>>selected="true"/>
>>   <select idref="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
>>selected="true"/>
>> -<select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
>>selected="true"/>
>> +<!-- Check not referenced in any Rule
>> +     <select 
>>idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
>>selected="true"/>
>> +-->
>>   <select idref="set_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
>>   <select idref="set_sysctl_net_ipv4_conf_all_rp_filter"
>>selected="true"/>
>>   <select idref="set_sysctl_net_ipv4_conf_default_rp_filter"
>>selected="true"/>
>> @@ -223,7 +225,9 @@ these should likely be moved out of common.
>>   <!-- net.ipv4.conf.default.secure_redirects -->
>>   <refine-value 
>>idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"
>>selector="enabled"/>
>>   <!-- net.ipv4.icmp_echo_ignore_broadcast -->
>> -<refine-value 
>>idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
>>selector="enabled"/>
>> +<!-- Value not referenced in any Rules
>> +	<refine-value 
>>idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
>>selector="enabled"/>
>> +-->
>>   <!-- net.ipv4.icmp_ignore_bogus_error_messages -->
>>   <refine-value idref="sysctl_net_ipv4_tcp_syncookies_value"
>>selector="enabled"/>
>>   <!-- net.ipv4.tcp_syncookie -->
>
>
>
>It's called out on
>scap-security-guide/RHEL6/input/system/network/kernel.xml:295

Consider me totally out of the loop at this point, and transforms might
address this, but isn't this snippet for a different ID?

>
>> <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
>> <title>Enable Kernel Parameter to Ignore Bogus ICMP Error
>>Messages</title>
>> <description>
>> <sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses"
>> value="1" />
>> </description>
>> <rationale>Ignoring bogus ICMP error responses reduces
>> log size, although some activity would not be logged.</rationale>
>> <ident cce="4133-5" />
>> <oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
>> value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
>> <ref nist="AC-3, CM-6, CM-7, SC-5" />
>> </Rule>
>
>It's then called out in the "common" XCCDF profile
>scap-security-guide/RHEL6/input/profiles/common.xml via....
>
>selection at scap-security-guide/RHEL6/input/profiles/common.xml:62
>> <select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
>> selected="true"/>
>
>and refinement at scap-security-guide/RHEL6/input/profiles/common.xml:226
>> <refine-value 
>> idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
>> selector="enabled"/>

This and the previous one might be the result of our custom profile and
was only reported due to bad grep'ing. Michael will confirm and get back
to you/list. 

Thanks,
--Spencer


>
>
>Unless I'm missing something (it happens...), nack
>_______________________________________________
>scap-security-guide mailing list
>scap-security-guide at lists.fedorahosted.org
>https://fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list