Bug 2081708

Description of problem:

After reviewing the sysctl_net_* SCAP rules in the OSPP profile, we propose removing the following groups of rules from the profile as they are not related to OSPP specific requirements. More detailed reasons are listed below:

Remove rules that just reenforce the RHEL 9 default without any specific OSPP requirement:

- sysctl_net_ipv4_conf_all_accept_source_route
- sysctl_net_ipv4_conf_default_accept_source_route
- sysctl_net_ipv6_conf_all_accept_source_route
- sysctl_net_ipv6_conf_default_accept_source_route

- sysctl_net_ipv4_conf_all_rp_filter
- sysctl_net_ipv4_conf_default_rp_filter

- sysctl_net_ipv4_icmp_ignore_bogus_error_responses

- sysctl_net_ipv4_icmp_echo_ignore_broadcasts

Remove rules that reenforce the RHEL 9 default, are not related to any specific OSPP requirement and affect important functionality:

- sysctl_net_ipv4_tcp_syncookies

  The TCP SYN cookies can prevent some TCP options from working.

Remove rules that change the RHEL 9 default value but are not related to any specific OSPP requirement and affect important functionality:

- sysctl_net_ipv6_conf_all_accept_ra
- sysctl_net_ipv6_conf_default_accept_ra

  Without accepting Router Advertisements (or without using DHCPv6 or static configuration), ability of hosts to use IPv6 becomes severely limited.

Remove rules that change the RHEL 9 default value but are not related to any specific OSPP requirement:

- sysctl_net_ipv4_conf_all_accept_redirects
- sysctl_net_ipv4_conf_default_accept_redirects
- sysctl_net_ipv6_conf_all_accept_redirects
- sysctl_net_ipv6_conf_default_accept_redirects

  While the need for accepting ICMP redirects often stems from suboptimal network layout and RHEL default should likely be changed to 0, accepting the redirects does not break any of the OSPP requirements.

Remove rules that change the RHEL 9 default but don't impact the security of the security of the TOE in any way:

- sysctl_net_ipv4_conf_all_send_redirects
- sysctl_net_ipv4_conf_default_send_redirects

Remove rules that change the RHEL 9 default value for wrong reason:

- sysctl_net_ipv4_conf_all_secure_redirects
- sysctl_net_ipv4_conf_default_secure_redirects

  This sysctl allows redirects only when they are considered secure. So the RHEL default (1) is more secure than what the SCAP rules actually try to achieve.

Remove rules that might help with detecting network issues but not related to TOE security:

- sysctl_net_ipv4_conf_all_log_martians
- sysctl_net_ipv4_conf_default_log_martians

Remove rules that prevent routing which is a valid use-case, also needed for containerized and VM-hosting setups:

- sysctl_net_ipv4_ip_forward

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.60-6.el9_0

How reproducible:

Deterministic.

Steps to Reproduce:
1. Run
   oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
   and check for any of the rules above.

Actual results:

They are listed.

Expected results:

None should be listed.

Additional info: