← All rules
SOCLE-CLD-SYS-034// Kernel & network (sysctl)mediumeffective runtime

Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces

Forces net.ipv4.conf.all.shared_media to 0 so the kernel does not treat subnets as sharing a medium and cannot implicitly re-enable secure ICMP redirects.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

shared_media tells the kernel that different subnets share the same physical medium, which makes it send ICMP redirects between those subnets. Critically, enabling shared_media for an interface also forces secure_redirects on, overriding the hardening of that parameter. To keep ICMP-redirect handling locked down, shared_media must be 0 so it cannot silently re-enable redirect acceptance and expose the host to redirect-based man-in-the-middle attacks.

What Pavois checks

Pavois reads the live runtime value of net.ipv4.conf.all.shared_media from the kernel (InSpec kernel_parameter, equivalent to sysctl), not a /etc/sysctl.d/ file. Because this parameter can override secure_redirects at runtime, only the effective kernel value reveals the true redirect posture, a config file might say 0 while a later drop-in or sysctl -w flipped it. Reading a file would miss that interaction.

describe kernel_parameter('net.ipv4.conf.all.shared_media') do
  its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.shared_media[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run sysctl net.ipv4.conf.all.shared_media. Expected output:

  • net.ipv4.conf.all.shared_media = 0

Then confirm sysctl net.ipv4.conf.all.secure_redirects still reads 0.

Inspect & investigate

No dedicated log exists. Inspect the state with sysctl net.ipv4.conf.all.shared_media and review the related redirect settings together with sysctl -a | grep -E 'shared_media|redirects'. With log_martians on, redirect anomalies show up via journalctl -k.

Remediation

Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.shared_media to 0, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

keynet.ipv4.conf.all.shared_media
resourcesysctl
value0
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Safe for standard topologies where each interface serves a single IP subnet. The rare exception is a network that genuinely runs multiple subnets on one shared physical medium and relies on the kernel issuing redirects between them; there, disabling shared_media can prevent hosts from learning optimal cross-subnet routes. For almost all servers this is not the case. Apply alongside the secure_redirects and send_redirects rules so the redirect posture stays consistent. No remote-access risk.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R12direct2.0high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references