[Patch] Duplicate Check for Disabling IPv6

Jeffrey Blank blank at eclipse.ncsc.mil
Mon May 13 23:37:32 UTC 2013


Oh, so also, ACK to Maura's patch.  We're only debating about how much
further to go, not debating its merits.


On Mon, May 13, 2013 at 7:32 PM, Jeffrey Blank <blank at eclipse.ncsc.mil>wrote:

> Yes. One of these should go.
>
> We have this, but it states that this sysctl causes "almost all of the
> calls into the module" to be disabled.
> https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17
>
> So the kernel module option seems stronger.  And would suggest we delete
> both sysctls.  Perhaps somebody from Red Hat engineering can offer an
> opinion.
>
>
>
>
>
> On Mon, May 13, 2013 at 3:50 PM, Shawn Wells <shawn at redhat.com> wrote:
>
>> On 5/13/13 3:43 PM, Maura Dailey wrote:
>>
>>> On 05/13/2013 03:24 PM, Shawn Wells wrote:
>>>
>>>> On 5/13/13 1:54 PM, Maura Dailey wrote:
>>>>
>>>>> The check RHEL6/input/checks/sysctl_net_**ipv6_disabled.xml is a
>>>>> duplicate of RHEL6/input/checks/sysctl_net_**
>>>>> ipv6_conf_all_disable_ipv6.**xml. Since sysctl_net_ipv6_conf_all_**disable_ipv6.xml
>>>>> matches the type and formatting of all the other sysctl checks, it seems
>>>>> that sysctl_net_ipv6_disabled.xml is the one to delete.
>>>>>
>>>>
>>>>
>>>> Actually, I think they both should be deleted. Neither is being called
>>>> from an XCCDF rule:
>>>>
>>>>> [shawn at rhel6 input]$ pwd
>>>>> /var/www/html/scap-security-**guide/RHEL6/input
>>>>>
>>>>> [shawn at rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *
>>>>> checks/sysctl_net_ipv6_**disabled.xml:2:  <definition
>>>>> class="compliance" id="sysctl_net_ipv6_disabled" version="1">
>>>>>
>>>>> [shawn at rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_**disable_ipv6
>>>>> *
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:2: <definition
>>>>> class="compliance" id="sysctl_net_ipv6_conf_all_**disable_ipv6"
>>>>> version="1">
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:13: <criterion
>>>>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1"
>>>>> test_ref="test_sysctl_net_**ipv6_conf_all_disable_ipv6" />
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:17:
>>>>> <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel
>>>>> runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1"
>>>>> id="test_sysctl_net_ipv6_conf_**all_disable_ipv6" version="1">
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:18: <unix:object
>>>>> object_ref="object_sysctl_net_**ipv6_conf_all_disable_ipv6" />
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:19: <unix:state
>>>>> state_ref="state_sysctl_net_**ipv6_conf_all_disable_ipv6" />
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:22:
>>>>> <unix:sysctl_object id="object_sysctl_net_ipv6_**conf_all_disable_ipv6"
>>>>> version="1">
>>>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:26:
>>>>> <unix:sysctl_state id="state_sysctl_net_ipv6_**conf_all_disable_ipv6"
>>>>> version="1">
>>>>>
>>>>
>>>> IIRC, these rules existed before we disabled IPv6 in the kernel &
>>>> modprobe via "Disable IPv6 Networking Support Automatic Loading" and
>>>> "Disable Interface Usage of IPv6." Is there any reason why we'd also
>>>> disable this in sysctl?
>>>>
>>>
>>> That thought also occurred to me. I'd think that the only reason to
>>> check for both is if both achieve the same effect equally well (in which
>>> case, the checks should probably be combined in an OR), or if we
>>> specifically wanted to give users that used sysctl checks from previous
>>> security guidance to get a pass.
>>>
>>
>> Other rules already exist to disable IPv6 at the kernel and module
>> levels. There seems little value to duplicate this through yet another
>> sysctl check.
>>
>> Anyone from the community have opinions?
>>
>>
>> ______________________________**_________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.**fedorahosted.org<scap-security-guide at lists.fedorahosted.org>
>> https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130513/2d16b8c6/attachment.html>


More information about the scap-security-guide mailing list