On 10/17/12 5:57 PM, Andrew Gilmore wrote:
Jeff said:
Yes -- there has been an outstanding ticket for
"research security-relevant gconf settings" for quite a while:
I twigged to this by looking at Steve Grubb's kickstart scripts for
securing at install, and wondered where this group was.
If you'd like to take stab at it, patches are welcome!
lol, we'll see after I get a chance to finish my server install to
test the project.
And Maura and Shawn pointed out ways to turn this off
GDM by default will read from the gconf settings folder in
the gdm user's home directory (/var/lib/gdm/.gconf).
gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
I implemented something that I'm not sure is sufficient:
gconftool-2 --direct
--config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory \
-t bool -s /apps/gdm/simple-greeter/disable_user_list true
IIRC, much of the existing content around gconf was blindly inherited
from the RHEL5 SNAC. Due diligence hasn't been done to see what holds
over to RHEL6.
Testing is the easier way, but I would think that the gdm user's
.gconf has already been populated at creation, and therefore misses
this setting that occurs after installation?
Where is the right place to put changes like these? Should I be
changing /var/lib/gdm/.gconf?
The gconftool-2 utility can persistently chance the
various values. I'm
a big proponent of letting tools do their job, versus writing scripts to
edit .gconf files directly (why write a script/tool when one already
exists?).
gconftool-2 -s to set a boolean, -g to verify it seems simple enough.