kernel_module_ipv6_option_disabled" passes causing sysctl_ipv6_default_accept_redirects failure.

Rodney L. Mercer rmercer at harris.com
Mon Dec 9 20:48:53 UTC 2013


When "Rule ID: kernel_module_ipv6_option_disabled" passes, "Rule ID:
sysctl_ipv6_default_accept_redirects" is doomed to failure.

I've figured out a fix for the failure of "Rule ID:
sysctl_ipv6_default_accept_redirects CCE-27166-8",
when "Rule ID: kernel_module_ipv6_option_disabled CCE-27153-6"
passes test.


I've attached the diff output between my changes and the original of the
sysctl_net_ipv6_conf_default_accept_redirects.xml file contents.

Unfortunately, the sysctl_net_ipv6_conf_default_accept_redirects.xml
file is generated by: create_sysctl_checks.py,  and the python script
does not take into account the problem.


Any suggestions for implementation are appreciated.

Thanks,
Rodney.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sysctl_net_ipv6_conf_default_accept_redirects.xml.diff
Type: text/x-patch
Size: 1293 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131209/266a2cac/attachment.bin>


More information about the scap-security-guide mailing list