[PATCH 1/3] [bugfix] ticket 285 - added Check language allowing forwarding for routers
Shawn Wells
shawn at redhat.com
Tue Mar 12 00:38:56 UTC 2013
On 3/11/13 6:35 PM, David Smith wrote:
> Signed-off-by: David Smith<dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/network/kernel.xml | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/system/network/kernel.xml b/RHEL6/input/system/network/kernel.xml
> index 0f80df2..104cf7c 100644
> --- a/RHEL6/input/system/network/kernel.xml
> +++ b/RHEL6/input/system/network/kernel.xml
> @@ -52,6 +52,7 @@ only appropriate for routers.</rationale>
> </description>
> <ocil>
> <sysctl-check-macro sysctl="net.ipv4.ip_forward" value="0" />
> +The ability to forward packets is only appropriate for routers.
> </ocil>
> <rationale>IP forwarding permits the kernel to forward packets from one network
> interface to another. The ability to forward packets between two networks is
> --
Systems running KVM will require this as well.
"The ability to forward packets is only appropriate for systems acting
as routers" seems a good compromise. Thoughts?
More information about the scap-security-guide
mailing list