<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/9/13, 3:48 PM, Rodney L. Mercer
wrote:<br>
</div>
<blockquote cite="mid:1386622133.2799.32.camel@osc145" type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-unicode">
<pre wrap="">When "Rule ID: kernel_module_ipv6_option_disabled" passes, "Rule ID:
sysctl_ipv6_default_accept_redirects" is doomed to failure.
I've figured out a fix for the failure of "Rule ID:
sysctl_ipv6_default_accept_redirects CCE-27166-8",
when "Rule ID: kernel_module_ipv6_option_disabled CCE-27153-6"
passes test.
I've attached the diff output between my changes and the original of the
sysctl_net_ipv6_conf_default_accept_redirects.xml file contents.
Unfortunately, the sysctl_net_ipv6_conf_default_accept_redirects.xml
file is generated by: create_sysctl_checks.py, and the python script
does not take into account the problem.
Any suggestions for implementation are appreciated.
Thanks,
Rodney.
</pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"><legend
class="mimeAttachmentHeaderName">sysctl_net_ipv6_conf_default_accept_redirects.xml.diff</legend></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-unicode">
<pre wrap="">[root@wahoo checks]# diff sysctl_net_ipv6_conf_default_accept_redirects.xml ~/sysctl_net_ipv6_conf_default_accept_redirects.xml.orig
12,22c12,14
< <criteria operator="OR">
< <criteria operator="AND">
< <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" />
< <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_redirects" />
< </criteria>
< <criteria operator="AND">
< <extend_definition comment="IPv6 disabled"
< definition_ref="kernel_module_ipv6_option_disabled" />
< <criterion comment="ipv6 disabled any modprobe conf file"
< test_ref="test_kernel_module_ipv6_option_disabled" />
< </criteria>
---
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap=""><span class="moz-txt-citetags">> </span> <criteria operator="AND">
<span class="moz-txt-citetags">> </span> <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" />
<span class="moz-txt-citetags">> </span> <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_redirects" />
</pre>
</blockquote>
</div>
</blockquote>
<br>
Works for me....<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo grep ipv6
/etc/modprobe.d/disabled.conf <br>
options ipv6 disable=1<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py
kernel_module_ipv6_option_disabled.xml <br>
Evaluating with OVAL tempfile :
/tmp/kernel_module_ipv6_option_disabledwCcEnH.xml<br>
Writing results to :
/tmp/kernel_module_ipv6_option_disabledwCcEnH.xml-results<br>
Definition oval:scap-security-guide.testing:def:323: true<br>
Evaluation done.<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo sysctl -a | grep
net.ipv6.conf.default.accept_redirects<br>
net.ipv6.conf.default.accept_redirects = 0<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo grep
"net.ipv6.conf.default.accept_redirects" /etc/sysctl.conf <br>
net.ipv6.conf.default.accept_redirects = 0<br>
<br>
[shawn@SSG-RHEL6 checks]$ ./testcheck.py
sysctl_net_ipv6_conf_default_accept_redirects.xml <br>
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsH7PBwZ.xml<br>
Writing results to :
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsH7PBwZ.xml-results<br>
Definition oval:scap-security-guide.testing:def:317: true<br>
Evaluation done.<br>
<br>
<br>
<br>
</body>
</html>