[PATCH] [RHEL/6] [RHEL/7] [shared] When checking for static IP address configuration in network scripts allow BOOTPROTO to match also "none" (since that's what system-config-network / nm-connection-editor do when creating static IP connection)

Jan Lieskovsky jlieskov at redhat.com
Fri May 30 13:51:27 UTC 2014

As noted in:
  [1] https://github.com/cobbler/cobbler/issues/361
  [2] https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-networkscripts-interfaces.html

BOOTPROTO variable in /etc/sysconfig/network-scripts can have just one of (none|bootp|dhcp) values.

Initscripts knowns also only these three:
  [3] https://git.fedorahosted.org/cgit/initscripts.git/tree/sysconfig.txt

meaning when 'bootp' or 'dhcp' options are used, the DHCP client is run on the device. Any other
option is dealt with / considered to mean static configuration.

When system-config-network / system-config-network-tui / nm-connection-editor creates new connection
with static IP configuration, it uses BOOTPROTO=none in the particular /etc/sysconfig/network-scripts/ifcfg-conn-name
script (can be verified by creating sample connection).

Based on bug:
  [4] https://bugzilla.redhat.com/show_bug.cgi?id=528068

and resulting patch:
  [5] http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=c31b3e455414a5a7bf57d9fed1442367e9e4c917

NetworkManager (starting from NetworkManager-0.7.996-5.git20091021.fc12) treats BOOTPROTO=static as an
alias for BOOTPROTO=none (doesn't complain when 'static' is used as BOOTPROTO specification).

But since RHEL-6 Deployment guide [2] and initscripts code [3] know / suggest use of 'none', enhance
the sysconfig_networking_bootproto_ifcfg OVAL check to allow test success also in case 'none' is used
as BOOTPROTO specification (since that actually is what is used, when new static IP using connection
is created e.g. via system-config-network or nm-connection-editor).

Besides that (support also for 'none' in BOOTPROTO specification), the patch starts to recommend to use
'none' on appropriate places (RHEL/6, RHEL/7 XCCDF rules description, stig reference) & moves originally
RHEL-6 specific sysconfig_networking_bootproto_ifcfg OVAL check to be shared one.

The change has been tested on both of RHEL/6 & RHEL/7, rpm(s) build correctly, the change seems to be
working as expected (on both products).

Please review.

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-RHEL-6-When-checking-for-static-IP-address-configura.patch
Type: text/x-patch
Size: 9036 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140530/e900948c/attachment-0001.bin>

More information about the scap-security-guide mailing list