[PATCH 1/1] The sysctl_values.csv has values that don't match the text. For example allowing source redirects.
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue May 22 20:52:14 UTC 2012
I ACK this. Please push.
Thanks very much for the QA.
On 05/22/2012 11:45 AM, Joe Nall wrote:
> Sorry for the lack of context on this, first experiment with git send-email.
>
> The checks being created by create_sysctl_checks.py from sysctl_values.csv don't match the prose because the csv values are incorrect. This patch fixes the csv and generated output.
>
> joe
>
>
>
> On May 22, 2012, at 11:08 AM, Joe Nall wrote:
>
>> ---
>> .../sysctl_net_ipv4_conf_all_accept_redirects.xml | 10 +++++-----
>> ...ysctl_net_ipv4_conf_all_accept_source_route.xml | 10 +++++-----
>> .../sysctl_net_ipv4_conf_all_secure_redirects.xml | 10 +++++-----
>> .../sysctl_net_ipv4_conf_all_send_redirects.xml | 10 +++++-----
>> ...sctl_net_ipv4_conf_default_accept_redirects.xml | 10 +++++-----
>> ...l_net_ipv4_conf_default_accept_source_route.xml | 10 +++++-----
>> ...sctl_net_ipv4_conf_default_secure_redirects.xml | 10 +++++-----
>> ...sysctl_net_ipv4_conf_default_send_redirects.xml | 10 +++++-----
>> ...sctl_net_ipv6_conf_default_accept_redirects.xml | 14 ++++++--------
>> rhel6/src/input/checks/templates/sysctl_values.csv | 18 +++++++++---------
>> 10 files changed, 55 insertions(+), 57 deletions(-)
>>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
>> index a11a8bd..eb21415 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_redirects" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4217-6" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_redirects" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
>> index 2753ef6..94f8766 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_all_accept_source_route" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_source_route" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4236-6" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_source_route" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_source_route" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
>> index 2e48ff9..5ddfeec 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_all_secure_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.all.secure_redirects" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-3472-8" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_secure_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_secure_redirects" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
>> index 8df01ac..8beb66f 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_all_send_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.all.send_redirects" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4155-8" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_all_send_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_all_send_redirects" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_all_send_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
>> index 9c942a2..f14f6f2 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_redirects" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4186-3" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_redirects" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
>> index ce3f564..4c45bca 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_default_accept_source_route" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_source_route" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4091-5" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 1" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_source_route" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_source_route" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
>> index 2e604ac..bf829cd 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_default_secure_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.default.secure_redirects" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-3339-9" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_secure_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_secure_redirects" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
>> index b0784d9..a4594e8 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv4_conf_default_send_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv4.conf.default.send_redirects" Check</title>
>> @@ -6,15 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4151-7" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description>
>> </metadata>
>> <criteria>
>> - <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
>> + <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 1" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv4_conf_default_send_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv4_conf_default_send_redirects" />
>> </unix:sysctl_test>
>> @@ -24,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv4_conf_default_send_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
>> index ce710b9..7978ba7 100644
>> --- a/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
>> +++ b/rhel6/src/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
>> @@ -1,4 +1,5 @@
>> <def-group>
>> + <!-- THIS FILE IS GENERATED by create_sysctl_checks.py. DO NOT EDIT. -->
>> <definition class="compliance" id="sysctl_net_ipv6_conf_default_accept_redirects" version="1">
>> <metadata>
>> <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_redirects" Check</title>
>> @@ -6,17 +7,14 @@
>> <platform>Red Hat Enterprise Linux 6</platform>
>> </affected>
>> <reference ref_id="CCE-4365-3" source="CCE" />
>> - <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "1".</description>
>> - <!-- generated by create_sysctl_checks.py -->
>> + <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description>
>> </metadata>
>> - <criteria operator="OR">
>> - <extend_definition comment="IPv6 disabled or..."
>> - definition_ref="kernel_module_ipv6_option_disabled" />
>> - <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
>> + <criteria>
>> + <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
>> </criteria>
>> </definition>
>>
>> - <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 1" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
>> + <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
>> <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_redirects" />
>> <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_redirects" />
>> </unix:sysctl_test>
>> @@ -26,6 +24,6 @@
>> </unix:sysctl_object>
>>
>> <unix:sysctl_state id="state_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
>> - <unix:value datatype="int" operation="equals">1</unix:value>
>> + <unix:value datatype="int" operation="equals">0</unix:value>
>> </unix:sysctl_state>
>> </def-group>
>> diff --git a/rhel6/src/input/checks/templates/sysctl_values.csv b/rhel6/src/input/checks/templates/sysctl_values.csv
>> index 549e847..75e2c6a 100644
>> --- a/rhel6/src/input/checks/templates/sysctl_values.csv
>> +++ b/rhel6/src/input/checks/templates/sysctl_values.csv
>> @@ -1,19 +1,19 @@
>> kernel.exec-shield,1,4168-1
>> kernel.randomize_va_space,1,4146-7
>> -net.ipv4.conf.all.accept_redirects,1,4217-6
>> -net.ipv4.conf.all.accept_source_route,1,4236-6
>> +net.ipv4.conf.all.accept_redirects,0,4217-6
>> +net.ipv4.conf.all.accept_source_route,0,4236-6
>> net.ipv4.conf.all.log_martians,1,4320-8
>> net.ipv4.conf.all.rp_filter,1,4080-8
>> -net.ipv4.conf.all.secure_redirects,1,3472-8
>> -net.ipv4.conf.all.send_redirects,1,4155-8
>> -net.ipv4.conf.default.accept_redirects,1,4186-3
>> -net.ipv4.conf.default.accept_source_route,1,4091-5
>> +net.ipv4.conf.all.secure_redirects,0,3472-8
>> +net.ipv4.conf.all.send_redirects,0,4155-8
>> +net.ipv4.conf.default.accept_redirects,0,4186-3
>> +net.ipv4.conf.default.accept_source_route,0,4091-5
>> net.ipv4.conf.default.rp_filter,1,3840-6
>> -net.ipv4.conf.default.secure_redirects,1,3339-9
>> -net.ipv4.conf.default.send_redirects,1,4151-7
>> +net.ipv4.conf.default.secure_redirects,0,3339-9
>> +net.ipv4.conf.default.send_redirects,0,4151-7
>> net.ipv4.icmp_echo_ignore_broadcasts,1,3644-2
>> net.ipv4.icmp_ignore_bogus_error_responses,1,4133-5
>> net.ipv4.ip_forward,0,3561-8
>> net.ipv4.tcp_syncookies,1,4265-5
>> net.ipv6.conf.all.disable_ipv6,1,4298-6
>> -net.ipv6.conf.default.accept_redirects,1,4365-3
>> +net.ipv6.conf.default.accept_redirects,0,4365-3
>> --
>> 1.7.1
>>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list