[PATCH] Commented out unreferenced check/value.

Shawn Wells shawn at redhat.com
Tue Jul 17 00:12:29 UTC 2012


On 7/16/12 7:22 PM, Michael Palmiotto wrote:
>>> +<!-- Check not referenced in any Rule
>>> +     <select
>>> idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
>>> selected="true"/>
>>> +-->
>>> +<!-- Value not referenced in any Rules
>>> +    <refine-value
>>> idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
>>> selector="enabled"/>
>>> +-->
>>> It's called out on
>>> scap-security-guide/RHEL6/input/system/network/kernel.xml:295
>> Consider me totally out of the loop at this point, and transforms might
>> address this, but isn't this snippet for a different ID?
>> Thanks
>> --Spencer
> I think you're actually both right and the blame lies in my court.
> Shawn was probably looking at the patch cover letter, while Spencer was
> looking at the diff.
>
> Let me clear this up.  The cover letter for my patch reflects the wrong
> idref (ie bogus_error_responses rather than bogus_error_messages).
> It was intended to say, "[PATCH] Commented out unreferenced
> sysctl_net_ipv4_icmp_ignore_bogus_error_messages check/value."
>
> I am still not seeing the bogus_error_messages check/value being
> referenced in any Rules.
>
> My apologies for the confusion.

Actually, looks like you found something much more fun.

[shawn at rhel6 input]$ grep -rni "set_sysctl_net_ipv4_icmp_ignore_bogus" *
profiles/common.xml:62:<select 
idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" 
selected="true"/>
system/network/kernel.xml:295:<Rule 
id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">


In kernel.xml:295, we have:
> <Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
> <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
.... here the title should be "... Error Responses"


And then in common.xml we have:
> <select idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages" 
> selected="true"/>
.... this really should be "...bogus_error_responses"


And then we have 
checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml, which 
should be deleted.

I'll make a quick patch for this.



More information about the scap-security-guide mailing list