[PATCH] [RHEL/6] [RHEL/7] [shared] When checking for static IP address configuration in network scripts allow BOOTPROTO to match also "none" (since that's what system-config-network / nm-connection-editor do when creating static IP connection)
jlieskov at redhat.com
Fri May 30 13:51:27 UTC 2014
As noted in:
BOOTPROTO variable in /etc/sysconfig/network-scripts can have just one of (none|bootp|dhcp) values.
Initscripts knowns also only these three:
meaning when 'bootp' or 'dhcp' options are used, the DHCP client is run on the device. Any other
option is dealt with / considered to mean static configuration.
When system-config-network / system-config-network-tui / nm-connection-editor creates new connection
with static IP configuration, it uses BOOTPROTO=none in the particular /etc/sysconfig/network-scripts/ifcfg-conn-name
script (can be verified by creating sample connection).
Based on bug:
and resulting patch:
NetworkManager (starting from NetworkManager-0.7.996-5.git20091021.fc12) treats BOOTPROTO=static as an
alias for BOOTPROTO=none (doesn't complain when 'static' is used as BOOTPROTO specification).
But since RHEL-6 Deployment guide  and initscripts code  know / suggest use of 'none', enhance
the sysconfig_networking_bootproto_ifcfg OVAL check to allow test success also in case 'none' is used
as BOOTPROTO specification (since that actually is what is used, when new static IP using connection
is created e.g. via system-config-network or nm-connection-editor).
Besides that (support also for 'none' in BOOTPROTO specification), the patch starts to recommend to use
'none' on appropriate places (RHEL/6, RHEL/7 XCCDF rules description, stig reference) & moves originally
RHEL-6 specific sysconfig_networking_bootproto_ifcfg OVAL check to be shared one.
The change has been tested on both of RHEL/6 & RHEL/7, rpm(s) build correctly, the change seems to be
working as expected (on both products).
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 9036 bytes
Desc: not available
More information about the scap-security-guide