[PATCH 1/1] The sysctl_values.csv has values that don't match the text. For example allowing source redirects.

Joe Nall joe at nall.com
Tue May 22 15:45:58 UTC 2012


Sorry for the lack of context on this, first experiment with git send-email.

The checks being created by create_sysctl_checks.py from sysctl_values.csv don't match the prose because the csv values are incorrect. This patch fixes the csv and generated output.

joe


 
On May 22, 2012, at 11:08 AM, Joe Nall wrote:

> ---
> .../sysctl_net_ipv4_conf_all_accept_redirects.xml  |   10 +++++-----
> ...ysctl_net_ipv4_conf_all_accept_source_route.xml |   10 +++++-----
> .../sysctl_net_ipv4_conf_all_secure_redirects.xml  |   10 +++++-----
> .../sysctl_net_ipv4_conf_all_send_redirects.xml    |   10 +++++-----
> ...sctl_net_ipv4_conf_default_accept_redirects.xml |   10 +++++-----
> ...l_net_ipv4_conf_default_accept_source_route.xml |   10 +++++-----
> ...sctl_net_ipv4_conf_default_secure_redirects.xml |   10 +++++-----
> ...sysctl_net_ipv4_conf_default_send_redirects.xml |   10 +++++-----
> ...sctl_net_ipv6_conf_default_accept_redirects.xml |   14 ++++++--------
> rhel6/src/input/checks/templates/sysctl_values.csv |   18 +++++++++---------
> 10 files changed, 55 insertions(+), 57 deletions(-)
> 
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
> index a11a8bd..eb21415 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_redirects" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4217-6" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_redirects" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
> index 2753ef6..94f8766 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_source_route" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_source_route" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4236-6" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_source_route" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_source_route" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
> index 2e48ff9..5ddfeec 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_all_secure_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.all.secure_redirects" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-3472-8" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_secure_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_secure_redirects" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
> index 8df01ac..8beb66f 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_all_send_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.all.send_redirects" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4155-8" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_send_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_send_redirects" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_send_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
> index 9c942a2..f14f6f2 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_redirects" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4186-3" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_redirects" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
> index ce3f564..4c45bca 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_source_route" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_source_route" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4091-5" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_source_route" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_source_route" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
> index 2e604ac..bf829cd 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_default_secure_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.default.secure_redirects" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-3339-9" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_secure_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_secure_redirects" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
> index b0784d9..a4594e8 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv4_conf_default_send_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv4.conf.default.send_redirects" Check</title>
> @@ -6,15 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4151-7" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description>
>     </metadata>
>     <criteria>
> -      <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
> +      <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_send_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_send_redirects" />
>   </unix:sysctl_test>
> @@ -24,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_send_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
> index ce710b9..7978ba7 100644
> --- a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
> +++ b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
> @@ -1,4 +1,5 @@
> <def-group>
> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
>   <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_redirects" version="1">
>     <metadata>
>       <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_redirects" Check</title>
> @@ -6,17 +7,14 @@
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <reference ref_id="CCE-4365-3" source="CCE" />
> -      <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "1".</description>
> -      <!-- generated by create_sysctl_checks.py -->
> +      <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description>
>     </metadata>
> -    <criteria operator="OR">
> -      <extend_definition comment="IPv6 disabled or..."
> -      definition_ref="kernel_module_ipv6_option_disabled" />
> -      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
> +    <criteria>
> +      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
>     </criteria>
>   </definition>
> 
> -  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
> +  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
>     <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_redirects" />
>     <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_redirects" />
>   </unix:sysctl_test>
> @@ -26,6 +24,6 @@
>   </unix:sysctl_object>
> 
>   <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
> -    <unix:value datatype="int" operation="equals">1</unix:value>
> +    <unix:value datatype="int" operation="equals">0</unix:value>
>   </unix:sysctl_state>
> </def-group>
> diff --git a/rhel6/src/input/checks/templates/sysctl_values.csv b/rhel6/src/input/checks/templates/sysctl_values.csv
> index 549e847..75e2c6a 100644
> --- a/rhel6/src/input/checks/templates/sysctl_values.csv
> +++ b/rhel6/src/input/checks/templates/sysctl_values.csv
> @@ -1,19 +1,19 @@
> kernel.exec-shield,1,4168-1
> kernel.randomize_va_space,1,4146-7
> -net.ipv4.conf.all.accept_redirects,1,4217-6
> -net.ipv4.conf.all.accept_source_route,1,4236-6
> +net.ipv4.conf.all.accept_redirects,0,4217-6
> +net.ipv4.conf.all.accept_source_route,0,4236-6
> net.ipv4.conf.all.log_martians,1,4320-8
> net.ipv4.conf.all.rp_filter,1,4080-8
> -net.ipv4.conf.all.secure_redirects,1,3472-8
> -net.ipv4.conf.all.send_redirects,1,4155-8
> -net.ipv4.conf.default.accept_redirects,1,4186-3
> -net.ipv4.conf.default.accept_source_route,1,4091-5
> +net.ipv4.conf.all.secure_redirects,0,3472-8
> +net.ipv4.conf.all.send_redirects,0,4155-8
> +net.ipv4.conf.default.accept_redirects,0,4186-3
> +net.ipv4.conf.default.accept_source_route,0,4091-5
> net.ipv4.conf.default.rp_filter,1,3840-6
> -net.ipv4.conf.default.secure_redirects,1,3339-9
> -net.ipv4.conf.default.send_redirects,1,4151-7
> +net.ipv4.conf.default.secure_redirects,0,3339-9
> +net.ipv4.conf.default.send_redirects,0,4151-7
> net.ipv4.icmp_echo_ignore_broadcasts,1,3644-2
> net.ipv4.icmp_ignore_bogus_error_responses,1,4133-5
> net.ipv4.ip_forward,0,3561-8
> net.ipv4.tcp_syncookies,1,4265-5
> net.ipv6.conf.all.disable_ipv6,1,4298-6
> -net.ipv6.conf.default.accept_redirects,1,4365-3
> +net.ipv6.conf.default.accept_redirects,0,4365-3
> -- 
> 1.7.1
> 



More information about the scap-security-guide mailing list