Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1797

Remediation of sysctl_net_ipv4_ip_forward rule breaks the sysctl_net_ipv4_conf_all_accept_redirects rule

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • None
    • Moderate
    • rhel-security-compliance
    • ssg_security
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None
    • None
    • Release Note Not Required
    • None
    • 57,005

      +++ This bug was initially created as a clone of Bug #1825810 +++

      Description of problem:
      Remediation of sysctl_net_ipv4_ip_forward rule breaks the sysctl_net_ipv4_conf_all_accept_redirects rule, this happens only when tested on "Server with GUI" installation.

      Version-Release number of selected component (if applicable):
      scap-security-guide-0.1.54-4.el8

      How reproducible:
      always

      Steps to Reproduce:
      1. Install RHEL-8.4 with "Server with GUI" package group and ANSSI enhanced profile
      2. Scan of a machine after installation reports a failing rule - sysctl_net_ipv4_ip_forward
      3. Fixing the rule (with `oscap xccdf eval --remediate --rule sysctl_net_ipv4_ip_forward`) makes the other rule to fail - sysctl_net_ipv4_conf_all_accept_redirects

      Actual results:
      Remediation of sysctl_net_ipv4_ip_forward rule breaks the sysctl_net_ipv4_conf_all_accept_redirects rule.

      Expected results:
      Remediation of sysctl_net_ipv4_ip_forward rule does not influence the result of sysctl_net_ipv4_conf_all_accept_redirects rule (maybe these rules cannot be selected in a profile together).

              vpolasek@redhat.com Vojtech Polasek
              mmarhefk@redhat.com Matus Marhefka
              Vojtech Polasek Vojtech Polasek
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: