[PATCH 1/3] [bugfix] ticket 285 - added Check language allowing forwarding for routers

Shawn Wells shawn at redhat.com
Tue Mar 12 00:38:56 UTC 2013


On 3/11/13 6:35 PM, David Smith wrote:
> Signed-off-by: David Smith<dsmith at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/network/kernel.xml |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
> index 0f80df2..104cf7c 100644
> --- a/RHEL6/input/system/network/kernel.xml
> +++ b/RHEL6/input/system/network/kernel.xml
> @@ -52,6 +52,7 @@ only appropriate for routers.</rationale>
>   </description>
>   <ocil>
>   <sysctl-check-macro sysctl="net.ipv4.ip_forward" value="0" />
> +The ability to forward packets is only appropriate for routers.
>   </ocil>
>   <rationale>IP forwarding permits the kernel to forward packets from one network
>   interface to another. The ability to forward packets between two networks is
> -- 

Systems running KVM will require this as well.

"The ability to forward packets is only appropriate for systems acting 
as routers" seems a good compromise. Thoughts?


More information about the scap-security-guide mailing list