I have been carefully watching the EL7 security guide remediation
development over the past few months hoping to get a leg up on the first
release of the EL7 DISA-STIG. I have really enjoyed the work all of the
contributors are putting in, at times the remediations have driven me to
look at solving other problems in more graceful ways! So thank you for all
the collective knowledge being put into this project!
So onto the question... I was looking at the gnome gui related items and
how dconf has replaced gconftool-2. I have already used dconf db files to
tweak gnome desktops and wonder if my testing strategy is faulty, or if
there is a shortcoming in limiting your search of dconf files to the
local.d directory, and perhaps not including the site.d directory as well.
Let's take the screensaver idle-delay as an example. It seems that
profiles typically follow this pattern: user->local->site. It's been my
experience through some basic testing of the possibilities, that when a
site level idle-delay and lock is in place, it overrides the local level
idle-delay and lock configuration the remediation would assert. This would
mean that the setting not comply with the SCAP test but still pass the
Does the community see this as an issue? Or perhaps this is designed to
allow for deviation from the standard?
Thanks for your input, and again especially for all the effort put in!