Sean,
This is what I've Identified so far with GNOME 3 lockdowns in RHEL 7 - please feel
free to contribute more or provide feedback:
https://github.com/RedHatGov/ssg-el7-kickstart/blob/master/config/hardeni...
(Starting with Line 588)
#!/bin/bash
########################################
# GNOME 3 Lockdowns
########################################
if [ -x /bin/gsettings ]; then
cat << EOF > /etc/dconf/db/gdm.d/99-gnome-hardening
[org/gnome/login-screen]
banner-message-enable=true
banner-message-text="${BANNER_MESSAGE_TEXT}"
disable-user-list=true
disable-restart-buttons=true
[org/gnome/desktop/lockdown]
user-administration-disabled=true
disable-user-switching=true
[org/gnome/desktop/media-handling]
automount=false
automount-open=false
autorun-never=true
[org/gnome/desktop/notifications]
show-in-lock-screen=false
[org/gnome/desktop/privacy]
remove-old-temp-files=true
remove-old-trash-files=true
old-files-age=7
[org/gnome/desktop/interface]
clock-format="12h"
[org/gnome/desktop/screensaver]
user-switch-enabled=false
[org/gnome/desktop/session]
idle-delay=900
[org/gnome/desktop/thumbnailers]
disable-all=true
[org/gnome/nm-applet]
disable-wifi-create=true
EOF
cat << EOF > /etc/dconf/db/gdm.d/locks/99-gnome-hardening
/org/gnome/login-screen/banner-message-enable
/org/gnome/login-screen/banner-message-text
/org/gnome/login-screen/disable-user-list
/org/gnome/login-screen/disable-restart-buttons
/org/gnome/desktop/lockdown/user-administration-disabled
/org/gnome/desktop/lockdown/disable-user-switching
/org/gnome/desktop/media-handling/automount
/org/gnome/desktop/media-handling/automount-open
/org/gnome/desktop/media-handling/autorun-never
/org/gnome/desktop/notifications/show-in-lock-screen
/org/gnome/desktop/privacy/remove-old-temp-files
/org/gnome/desktop/privacy/remove-old-trash-files
/org/gnome/desktop/privacy/old-files-age
/org/gnome/desktop/screensaver/user-switch-enabled
/org/gnome/desktop/session/idle-delay
/org/gnome/desktop/thumbnailers/disable-all
/org/gnome/nm-applet/disable-wifi-create
EOF
cat << EOF > /usr/share/glib-2.0/schemas/99-custom-settings.gschema.override
[org.gnome.login-screen]
banner-message-enable=true
banner-message-text="${BANNER_MESSAGE_TEXT}"
disable-user-list=true
disable-restart-buttons=true
[org.gnome.desktop.lockdown]
user-administration-disabled=true
disable-user-switching=true
[org.gnome.desktop.media-handling]
automount=false
automount-open=false
autorun-never=true
[org.gnome.desktop.notifications]
show-in-lock-screen=false
[org.gnome.desktop.privacy]
remove-old-temp-files=true
remove-old-trash-files=true
old-files-age=7
[org.gnome.desktop.interface]
clock-format="12h"
[org.gnome.desktop.screensaver]
user-switch-enabled=false
[org.gnome.desktop.session]
idle-delay=900
[org.gnome.desktop.thumbnailers]
disable-all=true
[org.gnome.nm-applet]
disable-wifi-create=true
EOF
cp /etc/dconf/db/gdm.d/locks/99-gnome-hardening
/etc/dconf/db/local.d/locks/99-gnome-hardening
/bin/glib-compile-schemas /usr/share/glib-2.0/schemas/
/bin/dconf update
fi
Regards,
Frank Caviggia
--
Frank Caviggia
Senior Consultant, Red Hat
fcaviggi(a)redhat.com
(M) (571) 295-4560
----- Original Message -----
From: "Sean" <smalder73(a)gmail.com>
To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org>
Sent: Friday, December 11, 2015 12:21:14 PM
Subject: Question regarding EL7 gnome/dconf remediation strategy
Hi all,
I have been carefully watching the EL7 security guide remediation development over the
past few months hoping to get a leg up on the first release of the EL7 DISA-STIG. I have
really enjoyed the work all of the contributors are putting in, at times the remediations
have driven me to look at solving other problems in more graceful ways! So thank you for
all the collective knowledge being put into this project!
So onto the question... I was looking at the gnome gui related items and how dconf has
replaced gconftool-2. I have already used dconf db files to tweak gnome desktops and
wonder if my testing strategy is faulty, or if there is a shortcoming in limiting your
search of dconf files to the local.d directory, and perhaps not including the site.d
directory as well.
Let's take the screensaver idle-delay as an example. It seems that profiles typically
follow this pattern: user->local->site. It's been my experience through some
basic testing of the possibilities, that when a site level idle-delay and lock is in
place, it overrides the local level idle-delay and lock configuration the remediation
would assert. This would mean that the setting not comply with the SCAP test but still
pass the test, right?
Does the community see this as an issue? Or perhaps this is designed to allow for
deviation from the standard?
Thanks for your input, and again especially for all the effort put in!
--Sean
--
SCAP Security Guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedo...
https://github.com/OpenSCAP/scap-security-guide/