[PATCH] Commented out unreferenced check/value.
Shawn Wells
shawn at redhat.com
Tue Jul 17 00:12:29 UTC 2012
On 7/16/12 7:22 PM, Michael Palmiotto wrote:
>>> +<!-- Check not referenced in any Rule
>>> + <select
>>> idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
>>> selected="true"/>
>>> +-->
>>> +<!-- Value not referenced in any Rules
>>> + <refine-value
>>> idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
>>> selector="enabled"/>
>>> +-->
>>> It's called out on
>>> scap-security-guide/RHEL6/input/system/network/kernel.xml:295
>> Consider me totally out of the loop at this point, and transforms might
>> address this, but isn't this snippet for a different ID?
>> Thanks
>> --Spencer
> I think you're actually both right and the blame lies in my court.
> Shawn was probably looking at the patch cover letter, while Spencer was
> looking at the diff.
>
> Let me clear this up. The cover letter for my patch reflects the wrong
> idref (ie bogus_error_responses rather than bogus_error_messages).
> It was intended to say, "[PATCH] Commented out unreferenced
> sysctl_net_ipv4_icmp_ignore_bogus_error_messages check/value."
>
> I am still not seeing the bogus_error_messages check/value being
> referenced in any Rules.
>
> My apologies for the confusion.
Actually, looks like you found something much more fun.
[shawn at rhel6 input]$ grep -rni "set_sysctl_net_ipv4_icmp_ignore_bogus" *
profiles/common.xml:62:<select
idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
system/network/kernel.xml:295:<Rule
id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
In kernel.xml:295, we have:
> <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
> <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
.... here the title should be "... Error Responses"
And then in common.xml we have:
> <select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
> selected="true"/>
.... this really should be "...bogus_error_responses"
And then we have
checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml, which
should be deleted.
I'll make a quick patch for this.
More information about the scap-security-guide
mailing list