<div dir="ltr">I'm not suggesting we do that at all. I'm disagreeing with Dan Walsh and suggesting that the IPv6 attack surface is smaller if we use kernel module options.</div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Mon, May 13, 2013 at 11:06 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div class="im">
<div>On 5/13/13 7:32 PM, Jeffrey Blank
wrote:<br>
</div>
<blockquote type="cite">Yes. One of these should go.
<div><br>
</div>
<div>We have this, but it states that this sysctl causes
"<span style="white-space:pre-wrap">almost all
of the calls into the module</span>" to be disabled.</div>
<div><a href="https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17</a><br>
</div>
<div><br>
</div>
<div>So the kernel module option seems stronger. And
would suggest we delete both sysctls. Perhaps somebody from Red
Hat engineering can offer an opinion.</div>
<div><br>
</div>
</blockquote>
<br></div>
Nice BZ link -- didn't know about the level of integration. <br>
<br>
Created <a href="https://fedorahosted.org/scap-security-guide/ticket/408" target="_blank">https://fedorahosted.org/scap-security-guide/ticket/408</a> to
track the creation of XCCDF against the sysctl_net_ipv6_conf_all_disable_ipv6<br>
<br>
Anyone want to grab that ticket? Actually, if someone has been
thinking about diving into content creation, I'd be happy to step
through the process with them. <br>
</div>
<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br></div>