[PATCH 7/8] updated OVAL template template_sysctl
Shawn Wells
shawn.d.wells at gmail.com
Sun Sep 29 00:16:48 UTC 2013
-------------- next part --------------
>From a3a7c7e986e323ba43777f7bc6c521c43e642411 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 28 Sep 2013 19:08:41 -0400
Subject: [PATCH 7/8] updated OVAL template: template_sysctl
- Prior edition of sysctl template only checked runtime configuration, added checks for /etc/sysctl.conf
- OVAL signoff
TESTING:
[root at SSG-RHEL6 output]# sudo sysctl -w kernel.exec-shield=0
kernel.exec-shield = 0
[root at SSG-RHEL6 output]# grep kernel.exec /etc/sysctl.conf
[root at SSG-RHEL6 output]# ../../testcheck.py sysctl_kernel_exec_shield.xml
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldKPQTPE.xml
Writing results to : /tmp/sysctl_kernel_exec_shieldKPQTPE.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Evaluation done.
[root at SSG-RHEL6 output]# sysctl -w kernel.exec-shield=1 ; ../../testcheck.py sysctl_kernel_exec_shield.xml
kernel.exec-shield = 1
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldqJhXKY.xml
Writing results to : /tmp/sysctl_kernel_exec_shieldqJhXKY.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Evaluation done.
[root at SSG-RHEL6 output]# echo "kernel.exec-shield = 1" >> /etc/sysctl.conf ; ../../testcheck.py sysctl_kernel_exec_shield.xml
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shield6ZVOVJ.xml
Writing results to : /tmp/sysctl_kernel_exec_shield6ZVOVJ.xml-results
Definition oval:scap-security-guide.testing:def:170: true
Evaluation done.
---
RHEL6/input/checks/sysctl_fs_suid_dumpable.xml | 18 +++++++++++++++---
.../input/checks/sysctl_kernel_dmesg_restrict.xml | 18 +++++++++++++++---
RHEL6/input/checks/sysctl_kernel_exec_shield.xml | 19 +++++++++++++++----
.../checks/sysctl_kernel_randomize_va_space.xml | 19 +++++++++++++++----
.../sysctl_net_ipv4_conf_all_accept_redirects.xml | 19 +++++++++++++++----
...ysctl_net_ipv4_conf_all_accept_source_route.xml | 19 +++++++++++++++----
.../sysctl_net_ipv4_conf_all_log_martians.xml | 19 +++++++++++++++----
.../checks/sysctl_net_ipv4_conf_all_rp_filter.xml | 18 +++++++++++++++---
.../sysctl_net_ipv4_conf_all_secure_redirects.xml | 19 +++++++++++++++----
.../sysctl_net_ipv4_conf_all_send_redirects.xml | 19 +++++++++++++++----
...sctl_net_ipv4_conf_default_accept_redirects.xml | 18 +++++++++++++++---
...l_net_ipv4_conf_default_accept_source_route.xml | 19 +++++++++++++++----
.../sysctl_net_ipv4_conf_default_rp_filter.xml | 18 +++++++++++++++---
...sctl_net_ipv4_conf_default_secure_redirects.xml | 18 +++++++++++++++---
...sysctl_net_ipv4_conf_default_send_redirects.xml | 19 +++++++++++++++----
...sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml | 18 +++++++++++++++---
..._net_ipv4_icmp_ignore_bogus_error_responses.xml | 18 +++++++++++++++---
RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml | 19 +++++++++++++++----
.../checks/sysctl_net_ipv4_tcp_syncookies.xml | 18 +++++++++++++++---
.../sysctl_net_ipv6_conf_default_accept_ra.xml | 18 +++++++++++++++---
...sctl_net_ipv6_conf_default_accept_redirects.xml | 18 +++++++++++++++---
RHEL6/input/checks/templates/template_sysctl | 18 +++++++++++++++---
22 files changed, 330 insertions(+), 76 deletions(-)
diff --git a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml
index e358366..324e98f 100644
--- a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml
+++ b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "fs.suid_dumpable" should be set to "0".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="test_sysctl_fs_suid_dumpable" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="test_runtime_sysctl_fs_suid_dumpable" />
+ <criterion comment="kernel /etc/sysctl.conf parameter fs.suid_dumpable set to 0" test_ref="test_static_sysctl_fs_suid_dumpable" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="test_sysctl_fs_suid_dumpable" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="test_runtime_sysctl_fs_suid_dumpable" version="1">
<unix:object object_ref="object_sysctl_fs_suid_dumpable" />
<unix:state state_ref="state_sysctl_fs_suid_dumpable" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration" id="test_static_sysctl_fs_suid_dumpable" version="1">
+ <ind:object object_ref="object_static_sysctl_fs_suid_dumpable" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_fs_suid_dumpable" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_fs_suid_dumpable" version="1">
<unix:name>fs.suid_dumpable</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
index c386a1d..f92c343 100644
--- a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
+++ b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "kernel.dmesg_restrict" should be set to "1".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="test_sysctl_kernel_dmesg_restrict" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="test_runtime_sysctl_kernel_dmesg_restrict" />
+ <criterion comment="kernel /etc/sysctl.conf parameter kernel.dmesg_restrict set to 1" test_ref="test_static_sysctl_kernel_dmesg_restrict" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="test_sysctl_kernel_dmesg_restrict" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="test_runtime_sysctl_kernel_dmesg_restrict" version="1">
<unix:object object_ref="object_sysctl_kernel_dmesg_restrict" />
<unix:state state_ref="state_sysctl_kernel_dmesg_restrict" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.dmesg_restrict static configuration" id="test_static_sysctl_kernel_dmesg_restrict" version="1">
+ <ind:object object_ref="object_static_sysctl_kernel_dmesg_restrict" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_kernel_dmesg_restrict" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_kernel_dmesg_restrict" version="1">
<unix:name>kernel.dmesg_restrict</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_kernel_exec_shield.xml b/RHEL6/input/checks/sysctl_kernel_exec_shield.xml
index 747de00..5567f65 100644
--- a/RHEL6/input/checks/sysctl_kernel_exec_shield.xml
+++ b/RHEL6/input/checks/sysctl_kernel_exec_shield.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "kernel.exec-shield" should be set to "1".</description>
- <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="test_sysctl_kernel_exec_shield" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="test_runtime_sysctl_kernel_exec_shield" />
+ <criterion comment="kernel /etc/sysctl.conf parameter kernel.exec-shield set to 1" test_ref="test_static_sysctl_kernel_exec_shield" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="test_sysctl_kernel_exec_shield" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="test_runtime_sysctl_kernel_exec_shield" version="1">
<unix:object object_ref="object_sysctl_kernel_exec_shield" />
<unix:state state_ref="state_sysctl_kernel_exec_shield" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.exec-shield static configuration" id="test_static_sysctl_kernel_exec_shield" version="1">
+ <ind:object object_ref="object_static_sysctl_kernel_exec_shield" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_kernel_exec_shield" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_kernel_exec_shield" version="1">
<unix:name>kernel.exec-shield</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
index 021856a..fc3ad18 100644
--- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
+++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "kernel.randomize_va_space" should be set to "2".</description>
- <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="test_sysctl_kernel_randomize_va_space" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="test_runtime_sysctl_kernel_randomize_va_space" />
+ <criterion comment="kernel /etc/sysctl.conf parameter kernel.randomize_va_space set to 2" test_ref="test_static_sysctl_kernel_randomize_va_space" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="test_sysctl_kernel_randomize_va_space" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="test_runtime_sysctl_kernel_randomize_va_space" version="1">
<unix:object object_ref="object_sysctl_kernel_randomize_va_space" />
<unix:state state_ref="state_sysctl_kernel_randomize_va_space" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration" id="test_static_sysctl_kernel_randomize_va_space" version="1">
+ <ind:object object_ref="object_static_sysctl_kernel_randomize_va_space" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_kernel_randomize_va_space" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_kernel_randomize_va_space" version="1">
<unix:name>kernel.randomize_va_space</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
index c013d27..c3f5397 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description>
- <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_accept_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_accept_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_accept_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
<unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
index e3e163b..aa59faf 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description>
- <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_accept_source_route" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_accept_source_route" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_source_route" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_source_route" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_source_route static configuration" id="test_static_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_accept_source_route" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
<unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml
index e11092f..2697ef8 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.all.log_martians" should be set to "1".</description>
- <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" test_ref="test_sysctl_net_ipv4_conf_all_log_martians" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" test_ref="test_runtime_sysctl_net_ipv4_conf_all_log_martians" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.log_martians set to 1" test_ref="test_static_sysctl_net_ipv4_conf_all_log_martians" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" id="test_sysctl_net_ipv4_conf_all_log_martians" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" id="test_runtime_sysctl_net_ipv4_conf_all_log_martians" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_log_martians" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_log_martians" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.log_martians static configuration" id="test_static_sysctl_net_ipv4_conf_all_log_martians" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_log_martians" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_log_martians" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_log_martians" version="1">
<unix:name>net.ipv4.conf.all.log_martians</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml
index 4ca98cc..a88e565 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.all.rp_filter" should be set to "1".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="test_sysctl_net_ipv4_conf_all_rp_filter" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="test_runtime_sysctl_net_ipv4_conf_all_rp_filter" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="test_static_sysctl_net_ipv4_conf_all_rp_filter" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" id="test_sysctl_net_ipv4_conf_all_rp_filter" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" id="test_runtime_sysctl_net_ipv4_conf_all_rp_filter" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_rp_filter" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_rp_filter" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.rp_filter static configuration" id="test_static_sysctl_net_ipv4_conf_all_rp_filter" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_rp_filter" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_rp_filter" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_rp_filter" version="1">
<unix:name>net.ipv4.conf.all.rp_filter</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
index 251cb42..216dd9f 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description>
- <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_secure_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_secure_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_secure_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_secure_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.secure_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_secure_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
<unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
index 55ce654..99c1482 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description>
- <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_send_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_send_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_send_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_all_send_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_all_send_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.send_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_send_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_send_redirects" version="1">
<unix:name>net.ipv4.conf.all.send_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
index dc64174..c89b481 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_accept_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_accept_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_accept_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
<unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
index 28c6602..97a270e 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description>
- <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_accept_source_route" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_accept_source_route" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_source_route" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_source_route" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_source_route static configuration" id="test_static_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_accept_source_route" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
<unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml
index 9fdd884..9e2f8d1 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.default.rp_filter" should be set to "1".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="test_sysctl_net_ipv4_conf_default_rp_filter" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="test_runtime_sysctl_net_ipv4_conf_default_rp_filter" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="test_static_sysctl_net_ipv4_conf_default_rp_filter" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" id="test_sysctl_net_ipv4_conf_default_rp_filter" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" id="test_runtime_sysctl_net_ipv4_conf_default_rp_filter" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_rp_filter" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_rp_filter" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.rp_filter static configuration" id="test_static_sysctl_net_ipv4_conf_default_rp_filter" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_rp_filter" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_rp_filter" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_rp_filter" version="1">
<unix:name>net.ipv4.conf.default.rp_filter</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
index 7b54d5e..83746db 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_secure_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_secure_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_secure_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_secure_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.secure_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_secure_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
<unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
index 261d26a..1fb964c 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description>
- <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_send_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_send_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_send_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_conf_default_send_redirects" />
<unix:state state_ref="state_sysctl_net_ipv4_conf_default_send_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.send_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_send_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_send_redirects" version="1">
<unix:name>net.ipv4.conf.default.send_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml
index c34f6e2..bac586d 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.icmp_echo_ignore_broadcasts" should be set to "1".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="test_runtime_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" id="test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" id="test_runtime_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
<unix:state state_ref="state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" id="test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
<unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml
index 87c7d45..51e924d 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.icmp_ignore_bogus_error_responses" should be set to "1".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="test_runtime_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" id="test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" id="test_runtime_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
<unix:state state_ref="state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" id="test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
<unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml b/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml
index 2203ade..914e979 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml
@@ -7,18 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.ip_forward" should be set to "0".</description>
- <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="test_sysctl_net_ipv4_ip_forward" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="test_runtime_sysctl_net_ipv4_ip_forward" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.ip_forward set to 0" test_ref="test_static_sysctl_net_ipv4_ip_forward" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="test_sysctl_net_ipv4_ip_forward" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="test_runtime_sysctl_net_ipv4_ip_forward" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_ip_forward" />
<unix:state state_ref="state_sysctl_net_ipv4_ip_forward" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="test_static_sysctl_net_ipv4_ip_forward" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_ip_forward" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_ip_forward" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_ip_forward" version="1">
<unix:name>net.ipv4.ip_forward</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml b/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml
index 78f7c2d..7842f2e 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv4.tcp_syncookies" should be set to "1".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" test_ref="test_sysctl_net_ipv4_tcp_syncookies" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" test_ref="test_runtime_sysctl_net_ipv4_tcp_syncookies" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.tcp_syncookies set to 1" test_ref="test_static_sysctl_net_ipv4_tcp_syncookies" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" id="test_sysctl_net_ipv4_tcp_syncookies" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" id="test_runtime_sysctl_net_ipv4_tcp_syncookies" version="1">
<unix:object object_ref="object_sysctl_net_ipv4_tcp_syncookies" />
<unix:state state_ref="state_sysctl_net_ipv4_tcp_syncookies" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.tcp_syncookies static configuration" id="test_static_sysctl_net_ipv4_tcp_syncookies" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv4_tcp_syncookies" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_tcp_syncookies" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*1*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv4_tcp_syncookies" version="1">
<unix:name>net.ipv4.tcp_syncookies</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
index b0f9ce5..1c7f64c 100644
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to "0".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_ra" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_ra" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_ra" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" id="test_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" id="test_runtime_sysctl_net_ipv6_conf_default_accept_ra" version="1">
<unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra" />
<unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra static configuration" id="test_static_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv6_conf_default_accept_ra" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_ra" version="1">
<unix:name>net.ipv6.conf.default.accept_ra</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
index a1fd06e..a116569 100644
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" />
+ <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_redirects" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
<unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_redirects" />
<unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_redirects" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_redirects static configuration" id="test_static_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+ <ind:object object_ref="object_static_sysctl_net_ipv6_conf_default_accept_redirects" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*0*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
<unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
</unix:sysctl_object>
diff --git a/RHEL6/input/checks/templates/template_sysctl b/RHEL6/input/checks/templates/template_sysctl
index e26f7b2..be623db 100644
--- a/RHEL6/input/checks/templates/template_sysctl
+++ b/RHEL6/input/checks/templates/template_sysctl
@@ -7,17 +7,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The kernel runtime parameter "SYSCTLVAR" should be set to "SYSCTLVAL".</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
- <criteria>
- <criterion comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" test_ref="test_sysctl_SYSCTLID" />
+ <criteria operator="AND">
+ <criterion comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" test_ref="test_runtime_sysctl_SYSCTLID" />
+ <criterion comment="kernel /etc/sysctl.conf parameter SYSCTLVAR set to SYSCTLVAL" test_ref="test_static_sysctl_SYSCTLID" />
</criteria>
</definition>
- <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" id="test_sysctl_SYSCTLID" version="1">
+ <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" id="test_runtime_sysctl_SYSCTLID" version="1">
<unix:object object_ref="object_sysctl_SYSCTLID" />
<unix:state state_ref="state_sysctl_SYSCTLID" />
</unix:sysctl_test>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="SYSCTLVAR static configuration" id="test_static_sysctl_SYSCTLID" version="1">
+ <ind:object object_ref="object_static_sysctl_SYSCTLID" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_static_sysctl_SYSCTLID" version="1">
+ <ind:filepath>/etc/sysctl.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*SYSCTLVAR[\s]*=[\s]*SYSCTLVAL*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
<unix:sysctl_object id="object_sysctl_SYSCTLID" version="1">
<unix:name>SYSCTLVAR</unix:name>
</unix:sysctl_object>
--
1.7.1
More information about the scap-security-guide
mailing list