[Patch] Duplicate Check for Disabling IPv6

Maura Dailey maura at eclipse.ncsc.mil
Mon May 13 19:43:07 UTC 2013


On 05/13/2013 03:24 PM, Shawn Wells wrote:
> On 5/13/13 1:54 PM, Maura Dailey wrote:
>> The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a 
>> duplicate of 
>> RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since 
>> sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and 
>> formatting of all the other sysctl checks, it seems that 
>> sysctl_net_ipv6_disabled.xml is the one to delete.
>
>
> Actually, I think they both should be deleted. Neither is being called 
> from an XCCDF rule:
>> [shawn at rhel6 input]$ pwd
>> /var/www/html/scap-security-guide/RHEL6/input
>>
>> [shawn at rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *
>> checks/sysctl_net_ipv6_disabled.xml:2:  <definition 
>> class="compliance" id="sysctl_net_ipv6_disabled" version="1">
>>
>> [shawn at rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_disable_ipv6 *
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:2: <definition 
>> class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6" 
>> version="1">
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:13: <criterion 
>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set 
>> to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" />
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:17: 
>> <unix:sysctl_test check="all" check_existence="all_exist" 
>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set 
>> to 1" id="test_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:18: <unix:object 
>> object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" />
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:19: <unix:state 
>> state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" />
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:22: 
>> <unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_disable_ipv6" 
>> version="1">
>> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:26: 
>> <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6" 
>> version="1">
>
> IIRC, these rules existed before we disabled IPv6 in the kernel & 
> modprobe via "Disable IPv6 Networking Support Automatic Loading" and 
> "Disable Interface Usage of IPv6." Is there any reason why we'd also 
> disable this in sysctl?

That thought also occurred to me. I'd think that the only reason to 
check for both is if both achieve the same effect equally well (in which 
case, the checks should probably be combined in an OR), or if we 
specifically wanted to give users that used sysctl checks from previous 
security guidance to get a pass.

> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list