[PATCH 13/15] Adding sysctl_net_ipv6_conf_all_accept_ra in support of C2S profile

Shawn Wells shawn at redhat.com
Fri Apr 18 03:33:09 UTC 2014


-------------- next part --------------
>From 1342fe250b5ec41ce9b42398efc139782e1158f0 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 17 Apr 2014 22:33:43 -0400
Subject: [PATCH 13/15] Adding sysctl_net_ipv6_conf_all_accept_ra in support of C2S profile

---
 .../checks/sysctl_net_ipv6_conf_all_accept_ra.xml  |   40 ++++++++++++++++++++
 .../bash/sysctl_net_ipv6_conf_all_accept_ra.sh     |   16 ++++++++
 RHEL/6/input/profiles/C2S.xml                      |    2 +-
 3 files changed, 57 insertions(+), 1 deletions(-)
 create mode 100644 RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml
 create mode 100644 RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh

diff --git a/RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml b/RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml
new file mode 100644
index 0000000..98da4b8
--- /dev/null
+++ b/RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml
@@ -0,0 +1,40 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_sysctl_checks.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="sysctl_net_ipv6_conf_all_accept_ra" version="1">
+    <metadata>
+      <title>Kernel Runtime Parameter "net.ipv6.conf.all.accept_ra" Check</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The kernel runtime parameter "net.ipv6.conf.all.accept_ra" should be set to "0".</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_all_accept_ra" />
+      <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.all.accept_ra set to 0" test_ref="test_static_sysctl_net_ipv6_conf_all_accept_ra" />
+    </criteria>
+  </definition>
+
+  <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to 0" id="test_runtime_sysctl_net_ipv6_conf_all_accept_ra" version="1">
+    <unix:object object_ref="object_sysctl_net_ipv6_conf_all_accept_ra" />
+    <unix:state state_ref="state_sysctl_net_ipv6_conf_all_accept_ra" />
+  </unix:sysctl_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra static configuration" id="test_static_sysctl_net_ipv6_conf_all_accept_ra" version="1">
+    <ind:object object_ref="object_static_sysctl_net_ipv6_conf_all_accept_ra" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_static_sysctl_net_ipv6_conf_all_accept_ra" version="1">
+    <ind:filepath>/etc/sysctl.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*0*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_accept_ra" version="1">
+    <unix:name>net.ipv6.conf.all.accept_ra</unix:name>
+  </unix:sysctl_object>
+
+  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_accept_ra" version="1">
+    <unix:value datatype="int" operation="equals">0</unix:value>
+  </unix:sysctl_state>
+</def-group>
diff --git a/RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh b/RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh
new file mode 100644
index 0000000..aa26b85
--- /dev/null
+++ b/RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv6.conf.all.accept_ra
+#
+sysctl -q -n -w net.ipv6.conf.all.accept_ra=0
+
+#
+# If net.ipv6.conf.all.accept_ra present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv6.conf.all.accept_ra = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv6.conf.all.accept_ra /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv6.conf.all.accept_ra.*/net.ipv6.conf.all.accept_ra = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv6.conf.all.accept_ra to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv6.conf.all.accept_ra = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL/6/input/profiles/C2S.xml b/RHEL/6/input/profiles/C2S.xml
index 161321e..f32ebdf 100644
--- a/RHEL/6/input/profiles/C2S.xml
+++ b/RHEL/6/input/profiles/C2S.xml
@@ -334,7 +334,7 @@ Patches would be most welcome!
 <!-- 4.4.1 Configure IPv6 -->
 <!-- 4.4.1.1 Disable IPv6 Router Advertisements (Not Scored) -->
 <select idref="sysctl_net_ipv6_conf_default_accept_ra" selected="true" />
-<!-- NEEDS: net.ipv6.conf.all.accept_ra -->
+<select idref="sysctl_net_ipv6_conf_all_accept_ra" selected="true" />
 
 <!-- 4.4.1.2 Disable IPv6 Redirect Acceptance (Not Scored) -->
 <select idref="sysctl_ipv6_default_accept_redirects" selected="true" />
-- 
1.7.1



More information about the scap-security-guide mailing list