Several of the GConf checks were using xmlfilecontent, which I liked, so I changed the ones that weren't to use it. However, the checks that had been using xmlfilecontent were improperly pointing to /etc/gconf/gconf.xml.defaults, when we wanted to be peering into gconf.xml.mandatory instead (this is where the gconf2-tool instructions were writing their values).
To add support to ensure these checks will no longer report a failure on machines that aren't using X, I added an extended definition check and the appropriate package checks to point to the lowest level package that installs GConf settings, namely the GConf2 package. On servers that don't have this package installed, the check will pass.
- Maura Dailey
Maura Dailey (1): Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- .../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> - ind:path/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - ind:filename%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable autorun in GNOME" + <ind:state state_ref="state_gconf_gnome_disable_automount" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1"> + <ind:value_of datatype="string">false</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1"> + ind:filepath/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='media_automount']/@value</ind:xpath> + </ind:xmlfilecontent_object> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> - ind:path/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - ind:filename%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> + ind:filepath/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='media_autorun_never']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> - ind:path/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path> - ind:filename%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> + ind:filepath/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='disable_all']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml index 5776014..0d012a7 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml @@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen saver should be enabled.</description> + <description>Idle activation of the screen saver should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver is activated on idle" id="test_gnome_screensaver_idle_activated" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver is activated on idle" + id="test_gnome_screensaver_idle_activated" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_activated" /> - <ind:state state_ref="state_activated_on_idle" /> + <ind:state state_ref="state_gnome_screensaver_idle_activated" /> </ind:xmlfilecontent_test> - <ind:xmlfilecontent_state id="state_activated_on_idle" version="1"> + <ind:xmlfilecontent_state id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1"> - ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value</ind:xpath> + ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object> - <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1"> - <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" /> + <ind:xmlfilecontent_state comment="idle timeout" + id="state_gnome_screensaver_idle_delay" version="1"> + <ind:value_of datatype="int" operation="less than or equal" var_check="all" + var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state> - <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" /> + <external_variable comment="inactivity timeout variable" datatype="int" + id="inactivity_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen lock should be enabled.</description> + <description>Idle activation of the screen lock should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1"> + <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" + id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1"> - ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver set to blank screen" + id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test> @@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1"> - ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text()</ind:xpath> + ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + ind:xpath/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed" version="1"> + linux:nameGConf2</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable autorun in GNOME" + <ind:state state_ref="state_gconf_gnome_disable_automount" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1"> + <ind:value_of datatype="string">false</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath> + </ind:xmlfilecontent_object> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml index 5776014..0d012a7 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml @@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen saver should be enabled.</description> + <description>Idle activation of the screen saver should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver is activated on idle" id="test_gnome_screensaver_idle_activated" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver is activated on idle" + id="test_gnome_screensaver_idle_activated" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_activated" /> - <ind:state state_ref="state_activated_on_idle" /> + <ind:state state_ref="state_gnome_screensaver_idle_activated" /> </ind:xmlfilecontent_test> - <ind:xmlfilecontent_state id="state_activated_on_idle" version="1"> + <ind:xmlfilecontent_state id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object> - <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1"> - <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" /> + <ind:xmlfilecontent_state comment="idle timeout" + id="state_gnome_screensaver_idle_delay" version="1"> + <ind:value_of datatype="int" operation="less than or equal" var_check="all" + var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state> - <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" /> + <external_variable comment="inactivity timeout variable" datatype="int" + id="inactivity_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen lock should be enabled.</description> + <description>Idle activation of the screen lock should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1"> + <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" + id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver set to blank screen" + id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test> @@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text()</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed" version="1"> + <linux:name>GConf2</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
On 12/16/13, 11:43 AM, Maura Dailey wrote:
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable autorun in GNOME" + <ind:state state_ref="state_gconf_gnome_disable_automount" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1"> + <ind:value_of datatype="string">false</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath> + </ind:xmlfilecontent_object> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml index 5776014..0d012a7 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml @@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen saver should be enabled.</description> + <description>Idle activation of the screen saver should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver is activated on idle" id="test_gnome_screensaver_idle_activated" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver is activated on idle" + id="test_gnome_screensaver_idle_activated" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_activated" /> - <ind:state state_ref="state_activated_on_idle" /> + <ind:state state_ref="state_gnome_screensaver_idle_activated" /> </ind:xmlfilecontent_test> - <ind:xmlfilecontent_state id="state_activated_on_idle" version="1"> + <ind:xmlfilecontent_state id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object> - <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1"> - <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" /> + <ind:xmlfilecontent_state comment="idle timeout" + id="state_gnome_screensaver_idle_delay" version="1"> + <ind:value_of datatype="int" operation="less than or equal" var_check="all" + var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state> - <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" /> + <external_variable comment="inactivity timeout variable" datatype="int" + id="inactivity_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen lock should be enabled.</description> + <description>Idle activation of the screen lock should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1"> + <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" + id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver set to blank screen" + id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test> @@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text()</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed" version="1"> + <linux:name>GConf2</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
This is great! Ack.
This tracks back to https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout after you've pushed and I'll resolve the bug.
I pushed it!
- Maura Dailey
On 12/16/2013 11:59 AM, Shawn Wells wrote:
On 12/16/13, 11:43 AM, Maura Dailey wrote:
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable autorun in GNOME" + <ind:state state_ref="state_gconf_gnome_disable_automount" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1"> + <ind:value_of datatype="string">false</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath> + </ind:xmlfilecontent_object> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
index 5776014..0d012a7 100644
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
+++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
@@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen saver should be
enabled.</description>
<description>Idle activation of the screen saver should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
is activated on idle" id="test_gnome_screensaver_idle_activated" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver is activated on idle"
- id="test_gnome_screensaver_idle_activated" version="1"> <ind:object
object_ref="object_gnome_screensaver_idle_activated" />
- <ind:state state_ref="state_activated_on_idle" />
- <ind:state state_ref="state_gnome_screensaver_idle_activated" /> </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_activated_on_idle" version="1">
- <ind:xmlfilecontent_state
id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object> - <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1"> - <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" /> + <ind:xmlfilecontent_state comment="idle timeout" + id="state_gnome_screensaver_idle_delay" version="1"> + <ind:value_of datatype="int" operation="less than or equal" var_check="all" + var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state> - <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" /> + <external_variable comment="inactivity timeout variable" datatype="int" + id="inactivity_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen lock should be enabled.</description> + <description>Idle activation of the screen lock should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1"> + <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" + id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver set to blank screen" + id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test> @@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text()</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed" version="1"> + <linux:name>GConf2</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
This is great! Ack.
This tracks back to https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout after you've pushed and I'll resolve the bug. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/16/13, 12:06 PM, Maura Dailey wrote:
I pushed it!
BZ resolved. Thanks again, and welcome back!
For the GConf checks, it looks like the content first used the ind-def:textfilecontent54_test and was just updated to use the ind-def:xmlfilecontent_test which seems like a good improvement to me.
Just curious, has anyone considered using the unix-def:gconf_test (http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/un... If so, are there any problems with the gconf_test that make using the ind-def:xmlfilecontent_test more desirable? This seems to be a good opportunity for me to get some feedback on the usability of the unix-def:gconf_test from an OVAL content authoring perspective :).
Thanks,
Danny
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap- security-guide-bounces@lists.fedorahosted.org] On Behalf Of Maura Dailey Sent: Monday, December 16, 2013 12:07 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
I pushed it!
- Maura Dailey
On 12/16/2013 11:59 AM, Shawn Wells wrote:
On 12/16/13, 11:43 AM, Maura Dailey wrote:
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644
RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> -
ind:path/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:p ath>
- ind:filename%gconf.xml</ind:filename>
- <ind:pattern operation="pattern
match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bo ol"\s+value="false"/.$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Disable autorun in GNOME"
- <ind:state state_ref="state_gconf_gnome_disable_automount" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state
id="state_gconf_gnome_disable_automount" version="1">
- <ind:value_of datatype="string">false</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount"
version="1">
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%g conf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='media_automount']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_test check="all" check_existence="all_exist"
- comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object
object_ref="obj_gconf_gnome_disable_automount_autorun" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="obj_gconf_gnome_disable_automount_autorun" version="1">
ind:path/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:p ath>
- ind:filename%gconf.xml</ind:filename>
- <ind:pattern operation="pattern
match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type= "bool"\s+value="true"/.$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:state
state_ref="state_gconf_gnome_disable_automount_autorun" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state
id="state_gconf_gnome_disable_automount_autorun" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object
id="obj_gconf_gnome_disable_automount_autorun" version="1">
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%g conf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='media_autorun_never']/@value</ind:xpat h>
- </ind:xmlfilecontent_object>
</def-group>
diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> -
ind:path/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</i nd:path>
- ind:filename%gconf.xml</ind:filename>
- <ind:pattern operation="pattern
match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+va lue="true"/.$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state
id="state_gconf_gnome_disable_thumbnailers" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object
id="obj_gconf_gnome_disable_thumbnailers" version="1">
ind:filepath/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers /%gconf.xml</ind:filepath>
- ind:xpath/gconf/entry[@name='disable_all']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
</def-group>
diff --git
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xm l
b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.x ml
index 5776014..0d012a7 100644
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xm l
+++
b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.x ml
@@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen saver should be
enabled.</description>
<description>Idle activation of the screen saver should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
is activated on idle" id="test_gnome_screensaver_idle_activated" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver is activated on idle"
- id="test_gnome_screensaver_idle_activated" version="1"> <ind:object
object_ref="object_gnome_screensaver_idle_activated" />
- <ind:state state_ref="state_activated_on_idle" />
- <ind:state state_ref="state_gnome_screensaver_idle_activated" /> </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_activated_on_idle" version="1">
- <ind:xmlfilecontent_state
id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gn ome- screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/defau lt[1]/@value</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpa th>
</ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
- <ind:xpath datatype="string"
operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@ name='gnome- screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value< /ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
- ind:xpath/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_state comment="idle timeout"
id="state_gnome_screensaver_idle_delay" version="1">
- <ind:value_of datatype="int" operation="less than or equal"
var_check="all" var_ref="inactivity_timeout_value" />
- <ind:xmlfilecontent_state comment="idle timeout"
- id="state_gnome_screensaver_idle_delay" version="1">
- <ind:value_of datatype="int" operation="less than or equal"
var_check="all"
- var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state>
- <external_variable comment="inactivity timeout variable"
datatype="int" id="inactivity_timeout_value" version="1" />
- <external_variable comment="inactivity timeout variable"
datatype="int"
- id="inactivity_timeout_value" version="1" />
</def-group>
diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen lock should be
enabled.</description>
<description>Idle activation of the screen lock should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="screensaver lock is
enabled" id="test_screensaver_lock_enabled" version="1">
- <ind:xmlfilecontent_test check="all" comment="screensaver lock is
enabled"
- id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled"
version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gn ome- screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@val ue</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
- ind:xpath/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled"
version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
set to blank screen" id="test_gnome_screensaver_mode" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver set to blank screen"
- id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test>
@@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gn ome- screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1 ]/text()</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
</ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed"
version="1">
- linux:nameGConf2</linux:name>
- </linux:rpminfo_object>
+</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
This is great! Ack.
This tracks back to https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout after you've pushed and I'll resolve the bug. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/16/2013 12:46 PM, Haynes, Dan wrote:
For the GConf checks, it looks like the content first used the ind-def:textfilecontent54_test and was just updated to use the ind-def:xmlfilecontent_test which seems like a good improvement to me.
Just curious, has anyone considered using the unix-def:gconf_test (http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/un... If so, are there any problems with the gconf_test that make using the ind-def:xmlfilecontent_test more desirable? This seems to be a good opportunity for me to get some feedback on the usability of the unix-def:gconf_test from an OVAL content authoring perspective :).
I saw the test, but it doesn't seem clear how to specify where to check for settings or if it's checking settings for a particular user. xmlfilecontent_test is much more precise, because it allows you to specify the exact file to check.
- Maura Dailey
Thanks,
Danny
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap- security-guide-bounces@lists.fedorahosted.org] On Behalf Of Maura Dailey Sent: Monday, December 16, 2013 12:07 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
I pushed it!
- Maura Dailey
On 12/16/2013 11:59 AM, Shawn Wells wrote:
On 12/16/13, 11:43 AM, Maura Dailey wrote:
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644
RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> -
ind:path/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:p ath>
- ind:filename%gconf.xml</ind:filename>
- <ind:pattern operation="pattern
match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bo ol"\s+value="false"/.$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="Disable autorun in GNOME"
- <ind:state state_ref="state_gconf_gnome_disable_automount" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state
id="state_gconf_gnome_disable_automount" version="1">
- <ind:value_of datatype="string">false</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount"
version="1">
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%g conf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='media_automount']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_test check="all" check_existence="all_exist"
- comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object
object_ref="obj_gconf_gnome_disable_automount_autorun" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object
id="obj_gconf_gnome_disable_automount_autorun" version="1">
ind:path/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:p ath>
- ind:filename%gconf.xml</ind:filename>
- <ind:pattern operation="pattern
match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type= "bool"\s+value="true"/.$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:state
state_ref="state_gconf_gnome_disable_automount_autorun" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state
id="state_gconf_gnome_disable_automount_autorun" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object
id="obj_gconf_gnome_disable_automount_autorun" version="1">
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%g conf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='media_autorun_never']/@value</ind:xpat h>
- </ind:xmlfilecontent_object>
</def-group>
diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> -
ind:path/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</i nd:path>
- ind:filename%gconf.xml</ind:filename>
- <ind:pattern operation="pattern
match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+va lue="true"/.$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" />
- </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state
id="state_gconf_gnome_disable_thumbnailers" version="1">
- <ind:value_of datatype="string">true</ind:value_of>
- </ind:xmlfilecontent_state>
- <ind:xmlfilecontent_object
id="obj_gconf_gnome_disable_thumbnailers" version="1">
ind:filepath/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers /%gconf.xml</ind:filepath>
- ind:xpath/gconf/entry[@name='disable_all']/@value</ind:xpath>
- </ind:xmlfilecontent_object>
</def-group>
diff --git
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xm l b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.x ml
index 5776014..0d012a7 100644
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xm l
+++
b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.x ml
@@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen saver should be
enabled.</description>
<description>Idle activation of the screen saver should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
is activated on idle" id="test_gnome_screensaver_idle_activated" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver is activated on idle"
- id="test_gnome_screensaver_idle_activated" version="1"> <ind:object
object_ref="object_gnome_screensaver_idle_activated" />
- <ind:state state_ref="state_activated_on_idle" />
- <ind:state state_ref="state_gnome_screensaver_idle_activated" /> </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_activated_on_idle" version="1">
- <ind:xmlfilecontent_state
id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gn ome- screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/defau lt[1]/@value</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpa th>
</ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
- <ind:xpath datatype="string"
operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@ name='gnome- screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value< /ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
- ind:xpath/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object>
- <ind:xmlfilecontent_state comment="idle timeout"
id="state_gnome_screensaver_idle_delay" version="1">
- <ind:value_of datatype="int" operation="less than or equal"
var_check="all" var_ref="inactivity_timeout_value" />
- <ind:xmlfilecontent_state comment="idle timeout"
- id="state_gnome_screensaver_idle_delay" version="1">
- <ind:value_of datatype="int" operation="less than or equal"
var_check="all"
- var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state>
- <external_variable comment="inactivity timeout variable"
datatype="int" id="inactivity_timeout_value" version="1" />
- <external_variable comment="inactivity timeout variable"
datatype="int"
- id="inactivity_timeout_value" version="1" />
</def-group>
diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen lock should be
enabled.</description>
<description>Idle activation of the screen lock should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="screensaver lock is
enabled" id="test_screensaver_lock_enabled" version="1">
- <ind:xmlfilecontent_test check="all" comment="screensaver lock is
enabled"
- id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled"
version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gn ome- screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@val ue</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
- ind:xpath/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled"
version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
set to blank screen" id="test_gnome_screensaver_mode" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver set to blank screen"
- id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test>
@@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-
tree.xml</ind:filepath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gn ome- screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1 ]/text()</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-
screensaver/%gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
</ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed"
version="1">
- linux:nameGConf2</linux:name>
- </linux:rpminfo_object>
+</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
This is great! Ack.
This tracks back to https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout after you've pushed and I'll resolve the bug. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/16/13, 12:51 PM, Maura Dailey wrote:
On 12/16/2013 12:46 PM, Haynes, Dan wrote:
For the GConf checks, it looks like the content first used the ind-def:textfilecontent54_test and was just updated to use the ind-def:xmlfilecontent_test which seems like a good improvement to me.
Just curious, has anyone considered using the unix-def:gconf_test (http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/un... If so, are there any problems with the gconf_test that make using the ind-def:xmlfilecontent_test more desirable? This seems to be a good opportunity for me to get some feedback on the usability of the unix-def:gconf_test from an OVAL content authoring perspective :).
I saw the test, but it doesn't seem clear how to specify where to check for settings or if it's checking settings for a particular user. xmlfilecontent_test is much more precise, because it allows you to specify the exact file to check.
Love the idea though. Dan, is there sample code (or would you be willing to generate some)?
Thanks for the feedback Maura! It was intended to allow content authors to check the values of settings. I will look into it a bit more though since it has been a couple of years since I last looked at this test :). In doing so, I will try to generate some sample content. As a side note, it looks like it is implemented in openscap.
Thanks,
Danny
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap- security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: Monday, December 16, 2013 1:21 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
On 12/16/13, 12:51 PM, Maura Dailey wrote:
On 12/16/2013 12:46 PM, Haynes, Dan wrote:
For the GConf checks, it looks like the content first used the ind-def:textfilecontent54_test and was just updated to use the ind-def:xmlfilecontent_test which seems like a good improvement to me.
Just curious, has anyone considered using the unix-def:gconf_test
(http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/ unix-definitions-schema.html#gconf_test)?
If so, are there any problems with the gconf_test that make using the ind-def:xmlfilecontent_test more desirable? This seems to be a good opportunity for me to get some feedback on the usability of the unix-def:gconf_test from an OVAL content authoring perspective :).
I saw the test, but it doesn't seem clear how to specify where to check for settings or if it's checking settings for a particular user. xmlfilecontent_test is much more precise, because it allows you to specify the exact file to check.
Love the idea though. Dan, is there sample code (or would you be willing to generate some)? _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Classification: UNCLASSIFIED Caveats: NONE
[Sorry for the delayed response, especially since I'm pretty sure I opened the BZ; I've been stupidly busy at work.]
The checks still seem to be looking at gconf.xml.defaults for:
gconf_gnome_screensaver_idle_activation_enabled.xml gconf_gnome_screensaver_idle_delay.xml gconf_gnome_screensaver_lock_enabled.xml gconf_gnome_screensaver_mode_blank.xml
Did something go awry with part of this patch? I do see the commit in the git log, and the "thumbnailers" check is looking at gconf.xml.mandatory.
-- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Maura Dailey Sent: Monday, December 16, 2013 12:07 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
I pushed it!
- Maura Dailey
On 12/16/2013 11:59 AM, Shawn Wells wrote:
On 12/16/13, 11:43 AM, Maura Dailey wrote:
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable autorun in GNOME" + <ind:state state_ref="state_gconf_gnome_disable_automount" /> + </ind:xmlfilecontent_test> <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1"> + <ind:value_of datatype="string">false</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc es/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath + > + </ind:xmlfilecontent_object> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc es/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpa th> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" + /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnail ers/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml
index 5776014..0d012a7 100644
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml
+++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml
@@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen saver should be
enabled.</description>
<description>Idle activation of the screen saver should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
is activated on idle" id="test_gnome_screensaver_idle_activated" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver is activated on idle"
- id="test_gnome_screensaver_idle_activated" version="1"> <ind:object
object_ref="object_gnome_screensaver_idle_activated" />
- <ind:state state_ref="state_activated_on_idle" />
- <ind:state state_ref="state_gnome_screensaver_idle_activated"
- /> </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_activated_on_idle"
version="1">
- <ind:xmlfilecontent_state
id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil epath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name=' gnome-screensaver']/entry[@name='idle_activation_enabled']/local_sch ema[1]/default[1]/@value</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir [@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1 ]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object> - <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1"> - <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" /> + <ind:xmlfilecontent_state comment="idle timeout" + id="state_gnome_screensaver_idle_delay" version="1"> + <ind:value_of datatype="int" operation="less than or equal" var_check="all" + var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state> - <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" /> + <external_variable comment="inactivity timeout variable" datatype="int" + id="inactivity_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen lock should be enabled.</description> + <description>Idle activation of the screen lock should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1"> + <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" + id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil epath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name=' gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/defa ult[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver set to blank screen" + id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test> @@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil epath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name=' gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/s tringvalue[1]/text()</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed" version="1"> + <linux:name>GConf2</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
This is great! Ack.
This tracks back to https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout after you've pushed and I'll resolve the bug. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Classification: UNCLASSIFIED Caveats: NONE
My local copy reports that it's correctly looking at gconf.xml.mandatory for all 4 listed checks, git diff comes back clean, and I only have one pending patch that I know about (fixing up some missing service and package checks). If someone else could confirm that there's a problem, I could reclone everything and try again.
- Maura Dailey
On 12/26/2013 02:07 PM, Shaw, Ray V CTR USARMY ARL (US) wrote:
Classification: UNCLASSIFIED Caveats: NONE
[Sorry for the delayed response, especially since I'm pretty sure I opened the BZ; I've been stupidly busy at work.]
The checks still seem to be looking at gconf.xml.defaults for:
gconf_gnome_screensaver_idle_activation_enabled.xml gconf_gnome_screensaver_idle_delay.xml gconf_gnome_screensaver_lock_enabled.xml gconf_gnome_screensaver_mode_blank.xml
Did something go awry with part of this patch? I do see the commit in the git log, and the "thumbnailers" check is looking at gconf.xml.mandatory.
-- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Maura Dailey Sent: Monday, December 16, 2013 12:07 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
I pushed it!
- Maura Dailey
On 12/16/2013 11:59 AM, Shawn Wells wrote:
On 12/16/13, 11:43 AM, Maura Dailey wrote:
I've been out sick, but I noticed that no one seems to have looked at this one. Let me know if I can push this or if I need to change something.
Thanks, Maura Dailey
On 11/25/2013 04:02 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
.../input/checks/gconf_gnome_disable_automount.xml | 59 +++++++++++--------- .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ .../input/checks/templates/packages_installed.csv | 1 + RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + 9 files changed, 124 insertions(+), 66 deletions(-) create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml index e2e7efc..f78fc89 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml @@ -1,41 +1,46 @@
<def-group> - <definition class="compliance" - id="gconf_gnome_disable_automount" version="1"> + <definition class="compliance" id="gconf_gnome_disable_automount" version="1"> <metadata> <title>Disable GNOME Automounting</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME.</description> + <description>The system's default desktop environment, GNOME, will mount + devices and removable media (such as DVDs, CDs and USB flash drives) + whenever they are inserted into the system. Disable automount and autorun + within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria operator="AND"> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" /> - <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> + <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable automount in GNOME" - id="test_gconf_gnome_disable_automount" version="1"> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount" + version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" - comment="Disable autorun in GNOME" + <ind:state state_ref="state_gconf_gnome_disable_automount" /> + </ind:xmlfilecontent_test> <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1"> + <ind:value_of datatype="string">false</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc es/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath + > + </ind:xmlfilecontent_object> + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable autorun in GNOME" id="test_gconf_gnome_disable_automount_autorun" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" /> + </ind:xmlfilecontent_test> + <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc es/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpa th> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml index 72bf086..80045a3 100644 --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml @@ -1,28 +1,32 @@ <def-group> - <definition class="compliance" - id="gconf_gnome_disable_thumbnailers" version="1"> + <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1"> <metadata> <title>Disable All GNOME Thumbnailers</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description> + <description>The system's default desktop environment, GNOME, uses a + number of different thumbnailer programs to generate thumbnails for any + new or modified content in an opened folder. Disable the execution of + these thumbnail applications within GNOME.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="none_exist" - comment="Disable thumbnailers in GNOME" + <ind:xmlfilecontent_test check="all" check_existence="all_exist" + comment="Disable thumbnailers in GNOME" id="test_gconf_gnome_disable_thumbnailers" version="1"> <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" /> - </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> - <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path> - <ind:filename>%gconf.xml</ind:filename> - <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> - </ind:textfilecontent54_object> - + <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" + /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> + <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1"> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnail ers/%gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath> + </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml
index 5776014..0d012a7 100644
a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml
+++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled .xml
@@ -5,21 +5,26 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected>
<description>Idle activation of the screen saver should be
enabled.</description>
<description>Idle activation of the screen saver should be
enabled.</description>
<reference source="MED" ref_id="20131125"
ref_url="test_attestation" /> </metadata>
<criteria>
<criteria operator="OR">
<extend_definition comment="GConf2 installed"
definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" /> </criteria> </definition>
- <ind:xmlfilecontent_test check="all" comment="gnome screensaver
is activated on idle" id="test_gnome_screensaver_idle_activated" version="1">
- <ind:xmlfilecontent_test check="all"
- comment="gnome screensaver is activated on idle"
- id="test_gnome_screensaver_idle_activated" version="1"> <ind:object
object_ref="object_gnome_screensaver_idle_activated" />
- <ind:state state_ref="state_activated_on_idle" />
- <ind:state state_ref="state_gnome_screensaver_idle_activated"
- /> </ind:xmlfilecontent_test>
- <ind:xmlfilecontent_state id="state_activated_on_idle"
version="1">
- <ind:xmlfilecontent_state
id="state_gnome_screensaver_idle_activated" version="1"> <ind:value_of datatype="string">true</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
ind:filepath/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil epath>
ind:xpath/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name=' gnome-screensaver']/entry[@name='idle_activation_enabled']/local_sch ema[1]/default[1]/@value</ind:xpath>
ind:filepath/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath>
ind:xpath/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object>
</def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml index 70cc1c2..c77e608 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml @@ -5,22 +5,30 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The allowed period of inactivity before the screensaver is activated.</description> + <description>The allowed period of inactivity before the screensaver is + activated.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1"> + <ind:xmlfilecontent_test check="all" + comment="test screensaver timeout period" + id="test_gnome_screensaver_idle_delay" version="1"> <ind:object object_ref="object_gnome_screensaver_idle_delay" /> <ind:state state_ref="state_gnome_screensaver_idle_delay" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath> - <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir [@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1 ]/default[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath> </ind:xmlfilecontent_object> - <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1"> - <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" /> + <ind:xmlfilecontent_state comment="idle timeout" + id="state_gnome_screensaver_idle_delay" version="1"> + <ind:value_of datatype="int" operation="less than or equal" var_check="all" + var_ref="inactivity_timeout_value" /> </ind:xmlfilecontent_state> - <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" /> + <external_variable comment="inactivity timeout variable" datatype="int" + id="inactivity_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml index 06d3020..cc031fc 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml @@ -5,19 +5,23 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Idle activation of the screen lock should be enabled.</description> + <description>Idle activation of the screen lock should be + enabled.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1"> + <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" + id="test_screensaver_lock_enabled" version="1"> <ind:object object_ref="object_screensaver_lock_enabled" /> <ind:state state_ref="state_screensaver_lock_enabled" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil epath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name=' gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/defa ult[1]/@value</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath> </ind:xmlfilecontent_object> <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1"> <ind:value_of datatype="string">true</ind:value_of> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml index 7cad7cd..8229d71 100644 --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml @@ -6,12 +6,16 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The screen saver should be blank.</description> + <reference source="MED" ref_id="20131125" ref_url="test_attestation" /> </metadata> - <criteria> + <criteria operator="OR"> + <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" /> <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" /> </criteria> </definition> - <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1"> + <ind:xmlfilecontent_test check="all" + comment="gnome screensaver set to blank screen" + id="test_gnome_screensaver_mode" version="1"> <ind:object object_ref="object_gnome_screensaver_mode" /> <ind:state state_ref="state_gnome_screensaver_mode" /> </ind:xmlfilecontent_test> @@ -19,7 +23,7 @@ <ind:value_of datatype="string">blank-only</ind:value_of> </ind:xmlfilecontent_state> <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1"> - <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil epath> - <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name=' gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/s tringvalue[1]/text()</ind:xpath> + <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ %gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath> </ind:xmlfilecontent_object> </def-group> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml new file mode 100644 index 0000000..032d76b --- /dev/null +++ b/RHEL6/input/checks/package_GConf2_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_GConf2_installed" + version="1"> + <metadata> + <title>Package GConf2 Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package GConf2 should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package GConf2 is installed" + test_ref="test_package_GConf2_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_GConf2_installed" version="1" + comment="package GConf2 is installed"> + <linux:object object_ref="obj_package_GConf2_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_GConf2_installed" version="1"> + <linux:name>GConf2</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index 990f332..d956daa 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,6 +1,7 @@ aide audit cronie +GConf2 iptables iptables-ipv6 irqbalance diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh new file mode 100644 index 0000000..02c8768 --- /dev/null +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh @@ -0,0 +1 @@ +yum -y install GConf2
This is great! Ack.
This tracks back to https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout after you've pushed and I'll resolve the bug. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Classification: UNCLASSIFIED Caveats: NONE
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/27/13, 1:04 PM, Maura Dailey wrote:
My local copy reports that it's correctly looking at gconf.xml.mandatory for all 4 listed checks, git diff comes back clean, and I only have one pending patch that I know about (fixing up some missing service and package checks). If someone else could confirm that there's a problem, I could reclone everything and try again.
The checks are against gconf.xml.defaults within the upstream git repo. Perhaps you have local patches/branches laying around?
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
- Maura Dailey
On 12/26/2013 02:07 PM, Shaw, Ray V CTR USARMY ARL (US) wrote:
Classification: UNCLASSIFIED Caveats: NONE
[Sorry for the delayed response, especially since I'm pretty sure I opened the BZ; I've been stupidly busy at work.]
The checks still seem to be looking at gconf.xml.defaults for:
gconf_gnome_screensaver_idle_activation_enabled.xml gconf_gnome_screensaver_idle_delay.xml gconf_gnome_screensaver_lock_enabled.xml gconf_gnome_screensaver_mode_blank.xml
Did something go awry with part of this patch? I do see the commit in the git log, and the "thumbnailers" check is looking at gconf.xml.mandatory.
...Sometimes I really hate git. The patches all show up as applied in my git log, no pending anything. I'm recloning and will try recommitting again in just a few minutes.
- Maura Dailey
On 12/27/2013 03:29 PM, Shawn Wells wrote:
On 12/27/13, 1:04 PM, Maura Dailey wrote:
My local copy reports that it's correctly looking at gconf.xml.mandatory for all 4 listed checks, git diff comes back clean, and I only have one pending patch that I know about (fixing up some missing service and package checks). If someone else could confirm that there's a problem, I could reclone everything and try again.
The checks are against gconf.xml.defaults within the upstream git repo. Perhaps you have local patches/branches laying around?
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/input/...
- Maura Dailey
On 12/26/2013 02:07 PM, Shaw, Ray V CTR USARMY ARL (US) wrote:
Classification: UNCLASSIFIED Caveats: NONE
[Sorry for the delayed response, especially since I'm pretty sure I opened the BZ; I've been stupidly busy at work.]
The checks still seem to be looking at gconf.xml.defaults for:
gconf_gnome_screensaver_idle_activation_enabled.xml gconf_gnome_screensaver_idle_delay.xml gconf_gnome_screensaver_lock_enabled.xml gconf_gnome_screensaver_mode_blank.xml
Did something go awry with part of this patch? I do see the commit in the git log, and the "thumbnailers" check is looking at gconf.xml.mandatory.
On 12/27/13, 3:42 PM, Maura Dailey wrote:
...Sometimes I really hate git. The patches all show up as applied in my git log, no pending anything. I'm recloning and will try recommitting again in just a few minutes.
I had the same thing just yesterday when Ray posted the RPM build was broke ;)
'git commit' showed no outstanding patches against origin, but sure enough there were a few.... I'd certainly be interested in hearing what I'm doing wrong if anyone knows!
Classification: UNCLASSIFIED Caveats: NONE
I can confirm that the GConf checks are working as expected (I got them all to pass), and I have no problems building. I'm having some other checks fail unexpectedly, but that's another topic! Thanks to both of you for the git wrangling.
-- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: Friday, December 27, 2013 3:56 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). (UNCLASSIFIED)
On 12/27/13, 3:42 PM, Maura Dailey wrote:
...Sometimes I really hate git. The patches all show up as applied in my git log, no pending anything. I'm recloning and will try recommitting again in just a few minutes.
I had the same thing just yesterday when Ray posted the RPM build was broke ;)
'git commit' showed no outstanding patches against origin, but sure enough there were a few.... I'd certainly be interested in hearing what I'm doing wrong if anyone knows! _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Classification: UNCLASSIFIED Caveats: NONE
Are you running git fetch before commit/status? If not, then commit/status have no way of knowing where HEAD currently is for origin.
Apologies if your git-fu is far beyond that, that particular issue bit me before,
Jeff
On 12/27/2013 03:56 PM, Shawn Wells wrote:
On 12/27/13, 3:42 PM, Maura Dailey wrote:
...Sometimes I really hate git. The patches all show up as applied in my git log, no pending anything. I'm recloning and will try recommitting again in just a few minutes.
I had the same thing just yesterday when Ray posted the RPM build was broke ;)
'git commit' showed no outstanding patches against origin, but sure enough there were a few.... I'd certainly be interested in hearing what I'm doing wrong if anyone knows! _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
I do a git pull. Does that include git fetch?
My git-fu is weak. I skipped subversion and went straight to git from CVS, so I make bad assumptions about how git works every once in a while.
- Maura Dailey
On 01/05/2014 01:23 PM, Jeff Bachtel wrote:
Are you running git fetch before commit/status? If not, then commit/status have no way of knowing where HEAD currently is for origin.
Apologies if your git-fu is far beyond that, that particular issue bit me before,
Jeff
On 12/27/2013 03:56 PM, Shawn Wells wrote:
On 12/27/13, 3:42 PM, Maura Dailey wrote:
...Sometimes I really hate git. The patches all show up as applied in my git log, no pending anything. I'm recloning and will try recommitting again in just a few minutes.
I had the same thing just yesterday when Ray posted the RPM build was broke ;)
'git commit' showed no outstanding patches against origin, but sure enough there were a few.... I'd certainly be interested in hearing what I'm doing wrong if anyone knows! _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 1/6/14, 11:18 AM, Maura Dailey wrote:
I do a git pull. Does that include git fetch?
My git-fu is weak. I skipped subversion and went straight to git from CVS, so I make bad assumptions about how git works every once in a while.
git pull == `git fetch && git merge`
On 1/6/14, 11:18 AM, Maura Dailey wrote:
I do a git pull. Does that include git fetch?
My git-fu is weak. I skipped subversion and went straight to git from CVS, so I make bad assumptions about how git works every once in a
while.
git pull == `git fetch && git merge`
I skipped subversion as well, so I understand your situation.
I've been doing "git pull --rebase", just in case any updates sneak in before I push.
Thanks, Leland
scap-security-guide@lists.fedorahosted.org