ansible-lockdown/UBUNTU22-CIS

IPv6 disabling doesn't respect declared mechanism

joshavant opened this issue · 0 comments

Describe the Issue
UBUNTU22-CIS is configured with the following:
ubtu22cis_ipv6_disable: grub
ubtu22cis_ipv6_required: false

Expected Behavior
After remediation, reloading sysctl.conf variables with sysctl -p returns exit code 0

Actual Behavior
After remediation, reloading sysctl.conf variables with sysctl -p returns exit code 255

Control(s) Affected
3.2.2, 3.3.1, 3.3.2

Environment (please complete the following information):

  • branch being used: devel
  • Ansible Version: 2.16.0
  • Host Python Version: N/A
  • Ansible Server Python Version: 2.7.16
  • Additional Details: Ubuntu 22.04.3 is Server OS

Additional Notes
Currently, remediation (without any direct rule overrides) will add lines to /etc/sysctl.conf relevant to IPv6 disabling, such as the following:
net.ipv6.conf.all.forwarding=0

If ubtu22cis_ipv6_disable is configured to grub, the IPv6 networking stack is not loaded by the kernel, and so files such as /proc/sys/net/ipv6/conf/all/forwarding are not created.

However, it appears sysctl's actual behavior is that, despite a line such as net.ipv6.conf.all.forwarding=0 existing in /etc/sysctl.conf to disable IPv6 behaviors, sysctl will still attempt to look for /proc/sys/net/ipv6/conf/all/forwarding and return a non-zero exit code if that file is not found.

Here is a sample output of current behavior, immediately after applying remediation:

ubuntu@ubuntu:~$ sudo sysctl -p
[sudo] password for ubuntu: 
fs.suid_dumpable = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.ip_forward = 0
sysctl: cannot stat /proc/sys/net/ipv6/conf/all/forwarding: No such file or directory
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
sysctl: cannot stat /proc/sys/net/ipv6/conf/all/accept_source_route: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/default/accept_source_route: No such file or directory
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
sysctl: cannot stat /proc/sys/net/ipv6/conf/all/accept_redirects: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/default/accept_redirects: No such file or directory
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.route.flush = 1
ubuntu@ubuntu:~$ echo $?
255

This non-zero exit code can cause other attempts to reload sysctl to appear to fail, when interpreting the returned exit code.

Possible Solution
#191