[PATCH 7/8] updated OVAL template template_sysctl

Shawn Wells shawn.d.wells at gmail.com
Sun Sep 29 00:16:48 UTC 2013


-------------- next part --------------
>From a3a7c7e986e323ba43777f7bc6c521c43e642411 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 28 Sep 2013 19:08:41 -0400
Subject: [PATCH 7/8] updated OVAL template: template_sysctl
 - Prior edition of sysctl template only checked runtime configuration, added checks for /etc/sysctl.conf
 - OVAL signoff

TESTING:
[root at SSG-RHEL6 output]# sudo sysctl -w kernel.exec-shield=0
kernel.exec-shield = 0
[root at SSG-RHEL6 output]# grep kernel.exec /etc/sysctl.conf
[root at SSG-RHEL6 output]# ../../testcheck.py sysctl_kernel_exec_shield.xml
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldKPQTPE.xml
Writing results to : /tmp/sysctl_kernel_exec_shieldKPQTPE.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Evaluation done.
[root at SSG-RHEL6 output]# sysctl -w kernel.exec-shield=1 ; ../../testcheck.py sysctl_kernel_exec_shield.xml
kernel.exec-shield = 1
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldqJhXKY.xml
Writing results to : /tmp/sysctl_kernel_exec_shieldqJhXKY.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Evaluation done.
[root at SSG-RHEL6 output]# echo "kernel.exec-shield = 1" >> /etc/sysctl.conf ; ../../testcheck.py sysctl_kernel_exec_shield.xml
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shield6ZVOVJ.xml
Writing results to : /tmp/sysctl_kernel_exec_shield6ZVOVJ.xml-results
Definition oval:scap-security-guide.testing:def:170: true
Evaluation done.
---
 RHEL6/input/checks/sysctl_fs_suid_dumpable.xml     |   18 +++++++++++++++---
 .../input/checks/sysctl_kernel_dmesg_restrict.xml  |   18 +++++++++++++++---
 RHEL6/input/checks/sysctl_kernel_exec_shield.xml   |   19 +++++++++++++++----
 .../checks/sysctl_kernel_randomize_va_space.xml    |   19 +++++++++++++++----
 .../sysctl_net_ipv4_conf_all_accept_redirects.xml  |   19 +++++++++++++++----
 ...ysctl_net_ipv4_conf_all_accept_source_route.xml |   19 +++++++++++++++----
 .../sysctl_net_ipv4_conf_all_log_martians.xml      |   19 +++++++++++++++----
 .../checks/sysctl_net_ipv4_conf_all_rp_filter.xml  |   18 +++++++++++++++---
 .../sysctl_net_ipv4_conf_all_secure_redirects.xml  |   19 +++++++++++++++----
 .../sysctl_net_ipv4_conf_all_send_redirects.xml    |   19 +++++++++++++++----
 ...sctl_net_ipv4_conf_default_accept_redirects.xml |   18 +++++++++++++++---
 ...l_net_ipv4_conf_default_accept_source_route.xml |   19 +++++++++++++++----
 .../sysctl_net_ipv4_conf_default_rp_filter.xml     |   18 +++++++++++++++---
 ...sctl_net_ipv4_conf_default_secure_redirects.xml |   18 +++++++++++++++---
 ...sysctl_net_ipv4_conf_default_send_redirects.xml |   19 +++++++++++++++----
 ...sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml |   18 +++++++++++++++---
 ..._net_ipv4_icmp_ignore_bogus_error_responses.xml |   18 +++++++++++++++---
 RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml  |   19 +++++++++++++++----
 .../checks/sysctl_net_ipv4_tcp_syncookies.xml      |   18 +++++++++++++++---
 .../sysctl_net_ipv6_conf_default_accept_ra.xml     |   18 +++++++++++++++---
 ...sctl_net_ipv6_conf_default_accept_redirects.xml |   18 +++++++++++++++---
 RHEL6/input/checks/templates/template_sysctl       |   18 +++++++++++++++---
 22 files changed, 330 insertions(+), 76 deletions(-)

diff --git a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml
index e358366..324e98f 100644
--- a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml
+++ b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "fs.suid_dumpable" should be set to "0".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="test_sysctl_fs_suid_dumpable" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="test_runtime_sysctl_fs_suid_dumpable" />
+      <criterion comment="kernel /etc/sysctl.conf parameter fs.suid_dumpable set to 0" test_ref="test_static_sysctl_fs_suid_dumpable" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="test_sysctl_fs_suid_dumpable" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="test_runtime_sysctl_fs_suid_dumpable" version="1">
     <unix:object object_ref="object_sysctl_fs_suid_dumpable" />
     <unix:state state_ref="state_sysctl_fs_suid_dumpable" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration" id="test_static_sysctl_fs_suid_dumpable" version="1">
+    <ind:object object_ref="object_static_sysctl_fs_suid_dumpable" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_fs_suid_dumpable" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_fs_suid_dumpable" version="1">
     <unix:name>fs.suid_dumpable</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
index c386a1d..f92c343 100644
--- a/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
+++ b/RHEL6/input/checks/sysctl_kernel_dmesg_restrict.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "kernel.dmesg_restrict" should be set to "1".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="test_sysctl_kernel_dmesg_restrict" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="test_runtime_sysctl_kernel_dmesg_restrict" />
+      <criterion comment="kernel /etc/sysctl.conf parameter kernel.dmesg_restrict set to 1" test_ref="test_static_sysctl_kernel_dmesg_restrict" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="test_sysctl_kernel_dmesg_restrict" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="test_runtime_sysctl_kernel_dmesg_restrict" version="1">
     <unix:object object_ref="object_sysctl_kernel_dmesg_restrict" />
     <unix:state state_ref="state_sysctl_kernel_dmesg_restrict" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.dmesg_restrict static configuration" id="test_static_sysctl_kernel_dmesg_restrict" version="1">
+    <ind:object object_ref="object_static_sysctl_kernel_dmesg_restrict" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_kernel_dmesg_restrict" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_kernel_dmesg_restrict" version="1">
     <unix:name>kernel.dmesg_restrict</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_kernel_exec_shield.xml b/RHEL6/input/checks/sysctl_kernel_exec_shield.xml
index 747de00..5567f65 100644
--- a/RHEL6/input/checks/sysctl_kernel_exec_shield.xml
+++ b/RHEL6/input/checks/sysctl_kernel_exec_shield.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "kernel.exec-shield" should be set to "1".</description>
-      <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="test_sysctl_kernel_exec_shield" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="test_runtime_sysctl_kernel_exec_shield" />
+      <criterion comment="kernel /etc/sysctl.conf parameter kernel.exec-shield set to 1" test_ref="test_static_sysctl_kernel_exec_shield" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="test_sysctl_kernel_exec_shield" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="test_runtime_sysctl_kernel_exec_shield" version="1">
     <unix:object object_ref="object_sysctl_kernel_exec_shield" />
     <unix:state state_ref="state_sysctl_kernel_exec_shield" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.exec-shield static configuration" id="test_static_sysctl_kernel_exec_shield" version="1">
+    <ind:object object_ref="object_static_sysctl_kernel_exec_shield" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_kernel_exec_shield" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_kernel_exec_shield" version="1">
     <unix:name>kernel.exec-shield</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
index 021856a..fc3ad18 100644
--- a/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
+++ b/RHEL6/input/checks/sysctl_kernel_randomize_va_space.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "kernel.randomize_va_space" should be set to "2".</description>
-      <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="test_sysctl_kernel_randomize_va_space" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="test_runtime_sysctl_kernel_randomize_va_space" />
+      <criterion comment="kernel /etc/sysctl.conf parameter kernel.randomize_va_space set to 2" test_ref="test_static_sysctl_kernel_randomize_va_space" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="test_sysctl_kernel_randomize_va_space" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="test_runtime_sysctl_kernel_randomize_va_space" version="1">
     <unix:object object_ref="object_sysctl_kernel_randomize_va_space" />
     <unix:state state_ref="state_sysctl_kernel_randomize_va_space" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration" id="test_static_sysctl_kernel_randomize_va_space" version="1">
+    <ind:object object_ref="object_static_sysctl_kernel_randomize_va_space" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_kernel_randomize_va_space" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_kernel_randomize_va_space" version="1">
     <unix:name>kernel.randomize_va_space</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
index c013d27..c3f5397 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_redirects.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description>
-      <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_accept_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_accept_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_accept_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_accept_redirects" version="1">
     <unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
index e3e163b..aa59faf 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_accept_source_route.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description>
-      <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_all_accept_source_route" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_accept_source_route" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_accept_source_route" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_accept_source_route" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_accept_source_route" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_source_route static configuration" id="test_static_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_accept_source_route" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_accept_source_route" version="1">
     <unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml
index e11092f..2697ef8 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_log_martians.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.all.log_martians" should be set to "1".</description>
-      <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" test_ref="test_sysctl_net_ipv4_conf_all_log_martians" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" test_ref="test_runtime_sysctl_net_ipv4_conf_all_log_martians" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.log_martians set to 1" test_ref="test_static_sysctl_net_ipv4_conf_all_log_martians" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" id="test_sysctl_net_ipv4_conf_all_log_martians" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" id="test_runtime_sysctl_net_ipv4_conf_all_log_martians" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_log_martians" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_log_martians" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.log_martians static configuration" id="test_static_sysctl_net_ipv4_conf_all_log_martians" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_log_martians" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_log_martians" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_log_martians" version="1">
     <unix:name>net.ipv4.conf.all.log_martians</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml
index 4ca98cc..a88e565 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_rp_filter.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.all.rp_filter" should be set to "1".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="test_sysctl_net_ipv4_conf_all_rp_filter" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="test_runtime_sysctl_net_ipv4_conf_all_rp_filter" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="test_static_sysctl_net_ipv4_conf_all_rp_filter" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" id="test_sysctl_net_ipv4_conf_all_rp_filter" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" id="test_runtime_sysctl_net_ipv4_conf_all_rp_filter" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_rp_filter" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_rp_filter" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.rp_filter static configuration" id="test_static_sysctl_net_ipv4_conf_all_rp_filter" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_rp_filter" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_rp_filter" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_rp_filter" version="1">
     <unix:name>net.ipv4.conf.all.rp_filter</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
index 251cb42..216dd9f 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_secure_redirects.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description>
-      <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_secure_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_secure_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_secure_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_secure_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_secure_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.secure_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_secure_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_secure_redirects" version="1">
     <unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
index 55ce654..99c1482 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_all_send_redirects.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description>
-      <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_all_send_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_all_send_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_all_send_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_all_send_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_all_send_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_all_send_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.send_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_all_send_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_all_send_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_all_send_redirects" version="1">
     <unix:name>net.ipv4.conf.all.send_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
index dc64174..c89b481 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_redirects.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_accept_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_accept_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_accept_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_accept_redirects" version="1">
     <unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
index 28c6602..97a270e 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_accept_source_route.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description>
-      <reference source="DS" ref_id="20130920" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_sysctl_net_ipv4_conf_default_accept_source_route" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_accept_source_route" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_accept_source_route" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_accept_source_route" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_accept_source_route" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_source_route static configuration" id="test_static_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_accept_source_route" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_accept_source_route" version="1">
     <unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml
index 9fdd884..9e2f8d1 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_rp_filter.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.default.rp_filter" should be set to "1".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="test_sysctl_net_ipv4_conf_default_rp_filter" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="test_runtime_sysctl_net_ipv4_conf_default_rp_filter" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="test_static_sysctl_net_ipv4_conf_default_rp_filter" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" id="test_sysctl_net_ipv4_conf_default_rp_filter" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" id="test_runtime_sysctl_net_ipv4_conf_default_rp_filter" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_rp_filter" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_rp_filter" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.rp_filter static configuration" id="test_static_sysctl_net_ipv4_conf_default_rp_filter" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_rp_filter" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_rp_filter" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_rp_filter" version="1">
     <unix:name>net.ipv4.conf.default.rp_filter</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
index 7b54d5e..83746db 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_secure_redirects.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_secure_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_secure_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_secure_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_secure_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_secure_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.secure_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_secure_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_secure_redirects" version="1">
     <unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
index 261d26a..1fb964c 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_conf_default_send_redirects.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description>
-      <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_sysctl_net_ipv4_conf_default_send_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv4_conf_default_send_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="test_static_sysctl_net_ipv4_conf_default_send_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="test_runtime_sysctl_net_ipv4_conf_default_send_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_conf_default_send_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv4_conf_default_send_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.send_redirects static configuration" id="test_static_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_conf_default_send_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_conf_default_send_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_conf_default_send_redirects" version="1">
     <unix:name>net.ipv4.conf.default.send_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml
index c34f6e2..bac586d 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.icmp_echo_ignore_broadcasts" should be set to "1".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="test_runtime_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" id="test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" id="test_runtime_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
     <unix:state state_ref="state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" id="test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" version="1">
     <unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml
index 87c7d45..51e924d 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.icmp_ignore_bogus_error_responses" should be set to "1".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="test_runtime_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" id="test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" id="test_runtime_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
     <unix:state state_ref="state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" id="test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" version="1">
     <unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml b/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml
index 2203ade..914e979 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_ip_forward.xml
@@ -7,18 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.ip_forward" should be set to "0".</description>
-      <reference source="DS" ref_id="20130919" ref_url="test_attestation" />
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="test_sysctl_net_ipv4_ip_forward" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="test_runtime_sysctl_net_ipv4_ip_forward" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.ip_forward set to 0" test_ref="test_static_sysctl_net_ipv4_ip_forward" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="test_sysctl_net_ipv4_ip_forward" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="test_runtime_sysctl_net_ipv4_ip_forward" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_ip_forward" />
     <unix:state state_ref="state_sysctl_net_ipv4_ip_forward" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="test_static_sysctl_net_ipv4_ip_forward" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_ip_forward" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_ip_forward" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_ip_forward" version="1">
     <unix:name>net.ipv4.ip_forward</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml b/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml
index 78f7c2d..7842f2e 100644
--- a/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv4_tcp_syncookies.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv4.tcp_syncookies" should be set to "1".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" test_ref="test_sysctl_net_ipv4_tcp_syncookies" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" test_ref="test_runtime_sysctl_net_ipv4_tcp_syncookies" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.tcp_syncookies set to 1" test_ref="test_static_sysctl_net_ipv4_tcp_syncookies" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" id="test_sysctl_net_ipv4_tcp_syncookies" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" id="test_runtime_sysctl_net_ipv4_tcp_syncookies" version="1">
     <unix:object object_ref="object_sysctl_net_ipv4_tcp_syncookies" />
     <unix:state state_ref="state_sysctl_net_ipv4_tcp_syncookies" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.tcp_syncookies static configuration" id="test_static_sysctl_net_ipv4_tcp_syncookies" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv4_tcp_syncookies" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv4_tcp_syncookies" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*1*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv4_tcp_syncookies" version="1">
     <unix:name>net.ipv4.tcp_syncookies</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
index b0f9ce5..1c7f64c 100644
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv6.conf.default.accept_ra" should be set to "0".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_ra" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_ra" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_ra set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_ra" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" id="test_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0" id="test_runtime_sysctl_net_ipv6_conf_default_accept_ra" version="1">
     <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_ra" />
     <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_ra" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra static configuration" id="test_static_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv6_conf_default_accept_ra" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv6_conf_default_accept_ra" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_ra" version="1">
     <unix:name>net.ipv6.conf.default.accept_ra</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
index a1fd06e..a116569 100644
--- a/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
+++ b/RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_redirects.xml
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_sysctl_net_ipv6_conf_default_accept_redirects" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_redirects" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
     <unix:object object_ref="object_sysctl_net_ipv6_conf_default_accept_redirects" />
     <unix:state state_ref="state_sysctl_net_ipv6_conf_default_accept_redirects" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_redirects static configuration" id="test_static_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv6_conf_default_accept_redirects" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_net_ipv6_conf_default_accept_redirects" version="1">
     <unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
   </unix:sysctl_object>
diff --git a/RHEL6/input/checks/templates/template_sysctl b/RHEL6/input/checks/templates/template_sysctl
index e26f7b2..be623db 100644
--- a/RHEL6/input/checks/templates/template_sysctl
+++ b/RHEL6/input/checks/templates/template_sysctl
@@ -7,17 +7,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The kernel runtime parameter "SYSCTLVAR" should be set to "SYSCTLVAL".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
-    <criteria>
-      <criterion comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" test_ref="test_sysctl_SYSCTLID" />
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" test_ref="test_runtime_sysctl_SYSCTLID" />
+      <criterion comment="kernel /etc/sysctl.conf parameter SYSCTLVAR set to SYSCTLVAL" test_ref="test_static_sysctl_SYSCTLID" />
     </criteria>
   </definition>
 
-  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" id="test_sysctl_SYSCTLID" version="1">
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter SYSCTLVAR set to SYSCTLVAL" id="test_runtime_sysctl_SYSCTLID" version="1">
     <unix:object object_ref="object_sysctl_SYSCTLID" />
     <unix:state state_ref="state_sysctl_SYSCTLID" />
   </unix:sysctl_test>
 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="SYSCTLVAR static configuration" id="test_static_sysctl_SYSCTLID" version="1">
+    <ind:object object_ref="object_static_sysctl_SYSCTLID" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_SYSCTLID" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*SYSCTLVAR[\s]*=[\s]*SYSCTLVAL*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
   <unix:sysctl_object id="object_sysctl_SYSCTLID" version="1">
     <unix:name>SYSCTLVAR</unix:name>
   </unix:sysctl_object>
-- 
1.7.1



More information about the scap-security-guide mailing list