From ptittle at cmf.nrl.navy.mil Thu Aug 20 11:36:54 2015 Content-Type: multipart/mixed; boundary="===============0560076695928214437==" MIME-Version: 1.0 From: Paul Tittle (Contractor) To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] allow enable_gdm_login_banner to pass if gdm isn't installed Date: Fri, 25 Apr 2014 11:34:07 -0400 Message-ID: <535A806F.8080203@cmf.nrl.navy.mil> In-Reply-To: 535A7CA6.7080603@eclipse.ncsc.mil --===============0560076695928214437== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Maura, That's a good observation. However, I have run across a use-case where = GConf2 is installed but gdm isn't: you can have vnc sessions that use = gnome-session. The other gconf checks are needed for that machine, but = the gdm one isn't. So I think it may be necessary to have a separate gdm = package check. On 4/25/14 11:17 AM, Maura Dailey wrote: > I have an open question that you and others can weigh in on. Should we = > introduce a new check, package_gdm_installed? Or is it sufficient to = > rely on the existing check GConf2, which has gdm as a dependency? I = > had this dilemma when I submitted the other more closely related = > GConf2 dependent checks, which is why I skipped the gui banner check. > > - Maura Dailey > > On 04/25/2014 10:47 AM, Paul Tittle wrote: >> --- >> RHEL/6/input/checks/banner_gui_enabled.xml | 3 +- >> RHEL/6/input/checks/package_gdm_installed.xml | 26 = >> ++++++++++++++++++++ >> .../input/checks/templates/packages_installed.csv | 1 + >> RHEL/6/input/fixes/bash/package_gdm_installed.sh | 1 + >> 4 files changed, 30 insertions(+), 1 deletions(-) >> create mode 100644 RHEL/6/input/checks/package_gdm_installed.xml >> create mode 100644 RHEL/6/input/fixes/bash/package_gdm_installed.sh >> >> diff --git a/RHEL/6/input/checks/banner_gui_enabled.xml = >> b/RHEL/6/input/checks/banner_gui_enabled.xml >> index a6c147c..4be3183 100644 >> --- a/RHEL/6/input/checks/banner_gui_enabled.xml >> +++ b/RHEL/6/input/checks/banner_gui_enabled.xml >> @@ -8,7 +8,8 @@ >> Enable the GUI warning banner. >> > ref_url=3D"test_attestation" /> >> >> - >> + >> + > definition_ref=3D"package_gdm_installed" negate=3D"true" /> >> > test_ref=3D"test_banner_gui_enabled" /> >> >> >> diff --git a/RHEL/6/input/checks/package_gdm_installed.xml = >> b/RHEL/6/input/checks/package_gdm_installed.xml >> new file mode 100644 >> index 0000000..b9ea21f >> --- /dev/null >> +++ b/RHEL/6/input/checks/package_gdm_installed.xml >> @@ -0,0 +1,26 @@ >> + >> + >> + > + version=3D"1"> >> + >> + Package gdm Installed >> + >> + Red Hat Enterprise Linux 6 >> + >> + The RPM package gdm should be = >> installed. >> + > ref_url=3D"test_attestation"/> >> + >> + >> + > + test_ref=3D"test_package_gdm_installed" /> >> + >> + >> + > + id=3D"test_package_gdm_installed" version=3D"1" >> + comment=3D"package gdm is installed"> >> + >> + >> + >> + gdm >> + >> + >> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv = >> b/RHEL/6/input/checks/templates/packages_installed.csv >> index 6dfc406..ef6e737 100644 >> --- a/RHEL/6/input/checks/templates/packages_installed.csv >> +++ b/RHEL/6/input/checks/templates/packages_installed.csv >> @@ -2,6 +2,7 @@ aide >> audit >> cronie >> GConf2 >> +gdm >> iptables >> iptables-ipv6 >> irqbalance >> diff --git a/RHEL/6/input/fixes/bash/package_gdm_installed.sh = >> b/RHEL/6/input/fixes/bash/package_gdm_installed.sh >> new file mode 100644 >> index 0000000..b5025fa >> --- /dev/null >> +++ b/RHEL/6/input/fixes/bash/package_gdm_installed.sh >> @@ -0,0 +1 @@ >> +yum -y install gdm > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide --===============0560076695928214437==--