[PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).

Maura Dailey maura at eclipse.ncsc.mil
Mon Dec 16 16:43:38 UTC 2013


I've been out sick, but I noticed that no one seems to have looked at 
this one. Let me know if I can push this or if I need to change something.

Thanks,
Maura Dailey

On 11/25/2013 04:02 PM, Maura Dailey wrote:
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
> ---
>   .../input/checks/gconf_gnome_disable_automount.xml |   59 +++++++++++---------
>   .../checks/gconf_gnome_disable_thumbnailers.xml    |   34 ++++++-----
>   ...f_gnome_screensaver_idle_activation_enabled.xml |   19 ++++--
>   .../checks/gconf_gnome_screensaver_idle_delay.xml  |   24 +++++---
>   .../gconf_gnome_screensaver_lock_enabled.xml       |   14 +++--
>   .../checks/gconf_gnome_screensaver_mode_blank.xml  |   12 +++-
>   RHEL6/input/checks/package_GConf2_installed.xml    |   26 +++++++++
>   .../input/checks/templates/packages_installed.csv  |    1 +
>   RHEL6/input/fixes/bash/package_GConf2_installed.sh |    1 +
>   9 files changed, 124 insertions(+), 66 deletions(-)
>   create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml
>   create mode 100644 RHEL6/input/fixes/bash/package_GConf2_installed.sh
>
> diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml b/RHEL6/input/checks/gconf_gnome_disable_automount.xml
> index e2e7efc..f78fc89 100644
> --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml
> +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml
> @@ -1,41 +1,46 @@
>   <def-group>
> -  <definition class="compliance"
> -  id="gconf_gnome_disable_automount" version="1">
> +  <definition class="compliance" id="gconf_gnome_disable_automount" version="1">
>       <metadata>
>         <title>Disable GNOME Automounting</title>
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system.  Disable automount and autorun within GNOME.</description>
> +      <description>The system's default desktop environment, GNOME, will mount
> +      devices and removable media (such as DVDs, CDs and USB flash drives)
> +      whenever they are inserted into the system. Disable automount and autorun
> +      within GNOME.</description>
> +      <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
>       </metadata>
> -    <criteria operator="AND">
> +    <criteria operator="OR">
> +      <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
>         <criterion comment="Disable automount in GNOME" test_ref="test_gconf_gnome_disable_automount" />
> -      <criterion comment="Disable autorun in GNOME"   test_ref="test_gconf_gnome_disable_automount_autorun" />
> +      <criterion comment="Disable autorun in GNOME" test_ref="test_gconf_gnome_disable_automount_autorun" />
>       </criteria>
>     </definition>
> -
> -  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> -  comment="Disable automount in GNOME"
> -  id="test_gconf_gnome_disable_automount" version="1">
> +  <ind:xmlfilecontent_test check="all" check_existence="all_exist"
> +  comment="Disable automount in GNOME" id="test_gconf_gnome_disable_automount"
> +  version="1">
>       <ind:object object_ref="obj_gconf_gnome_disable_automount" />
> -  </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount" version="1">
> -    <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path>
> -    <ind:filename>%gconf.xml</ind:filename>
> -    <ind:pattern operation="pattern match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> -  </ind:textfilecontent54_object>
> -
> -  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> -  comment="Disable autorun in GNOME"
> +    <ind:state state_ref="state_gconf_gnome_disable_automount" />
> +  </ind:xmlfilecontent_test>
> +  <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount" version="1">
> +    <ind:value_of datatype="string">false</ind:value_of>
> +  </ind:xmlfilecontent_state>
> +  <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount" version="1">
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath>
> +  </ind:xmlfilecontent_object>
> +  <ind:xmlfilecontent_test check="all" check_existence="all_exist"
> +  comment="Disable autorun in GNOME"
>     id="test_gconf_gnome_disable_automount_autorun" version="1">
>       <ind:object object_ref="obj_gconf_gnome_disable_automount_autorun" />
> -  </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="obj_gconf_gnome_disable_automount_autorun" version="1">
> -    <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path>
> -    <ind:filename>%gconf.xml</ind:filename>
> -    <ind:pattern operation="pattern match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> -  </ind:textfilecontent54_object>
> -
> +    <ind:state state_ref="state_gconf_gnome_disable_automount_autorun" />
> +  </ind:xmlfilecontent_test>
> +  <ind:xmlfilecontent_state id="state_gconf_gnome_disable_automount_autorun" version="1">
> +    <ind:value_of datatype="string">true</ind:value_of>
> +  </ind:xmlfilecontent_state>
> +  <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount_autorun" version="1">
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpath>
> +  </ind:xmlfilecontent_object>
>   </def-group>
> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
> index 72bf086..80045a3 100644
> --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
> +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
> @@ -1,28 +1,32 @@
>   <def-group>
> -  <definition class="compliance"
> -  id="gconf_gnome_disable_thumbnailers" version="1">
> +  <definition class="compliance" id="gconf_gnome_disable_thumbnailers" version="1">
>       <metadata>
>         <title>Disable All GNOME Thumbnailers</title>
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. Disable the execution of these thumbnail applications within GNOME.</description>
> +      <description>The system's default desktop environment, GNOME, uses a
> +      number of different thumbnailer programs to generate thumbnails for any
> +      new or modified content in an opened folder. Disable the execution of
> +      these thumbnail applications within GNOME.</description>
> +      <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
> +      <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
>         <criterion comment="Disable thumbnailers in GNOME" test_ref="test_gconf_gnome_disable_thumbnailers" />
>       </criteria>
>     </definition>
> -
> -  <ind:textfilecontent54_test check="all" check_existence="none_exist"
> -  comment="Disable thumbnailers in GNOME"
> +  <ind:xmlfilecontent_test check="all" check_existence="all_exist"
> +  comment="Disable thumbnailers in GNOME"
>     id="test_gconf_gnome_disable_thumbnailers" version="1">
>       <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers" />
> -  </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="obj_gconf_gnome_disable_thumbnailers" version="1">
> -    <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path>
> -    <ind:filename>%gconf.xml</ind:filename>
> -    <ind:pattern operation="pattern match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> -  </ind:textfilecontent54_object>
> -
> +    <ind:state state_ref="state_gconf_gnome_disable_thumbnailers" />
> +  </ind:xmlfilecontent_test>
> +  <ind:xmlfilecontent_state id="state_gconf_gnome_disable_thumbnailers" version="1">
> +    <ind:value_of datatype="string">true</ind:value_of>
> +  </ind:xmlfilecontent_state>
> +  <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_thumbnailers" version="1">
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath>
> +  </ind:xmlfilecontent_object>
>   </def-group>
> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
> index 5776014..0d012a7 100644
> --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xml
> @@ -5,21 +5,26 @@
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>Idle activation of the screen saver should be enabled.</description>
> +      <description>Idle activation of the screen saver should be
> +      enabled.</description>
> +      <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
> +      <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
>         <criterion comment="gnome screensaver is activated on idle" test_ref="test_gnome_screensaver_idle_activated" />
>       </criteria>
>     </definition>
> -  <ind:xmlfilecontent_test check="all" comment="gnome screensaver is activated on idle" id="test_gnome_screensaver_idle_activated" version="1">
> +  <ind:xmlfilecontent_test check="all"
> +  comment="gnome screensaver is activated on idle"
> +  id="test_gnome_screensaver_idle_activated" version="1">
>       <ind:object object_ref="object_gnome_screensaver_idle_activated" />
> -    <ind:state state_ref="state_activated_on_idle" />
> +    <ind:state state_ref="state_gnome_screensaver_idle_activated" />
>     </ind:xmlfilecontent_test>
> -  <ind:xmlfilecontent_state id="state_activated_on_idle" version="1">
> +  <ind:xmlfilecontent_state id="state_gnome_screensaver_idle_activated" version="1">
>       <ind:value_of datatype="string">true</ind:value_of>
>     </ind:xmlfilecontent_state>
>     <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_activated" version="1">
> -    <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath>
> -    <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_activation_enabled']/local_schema[1]/default[1]/@value</ind:xpath>
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath>
>     </ind:xmlfilecontent_object>
>   </def-group>
> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
> index 70cc1c2..c77e608 100644
> --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
> @@ -5,22 +5,30 @@
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>The allowed period of inactivity before the screensaver is activated.</description>
> +      <description>The allowed period of inactivity before the screensaver is
> +      activated.</description>
> +      <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
> +      <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
>         <criterion comment="check value of idle_delay in GCONF" test_ref="test_gnome_screensaver_idle_delay" />
>       </criteria>
>     </definition>
> -  <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="test_gnome_screensaver_idle_delay" version="1">
> +  <ind:xmlfilecontent_test check="all"
> +  comment="test screensaver timeout period"
> +  id="test_gnome_screensaver_idle_delay" version="1">
>       <ind:object object_ref="object_gnome_screensaver_idle_delay" />
>       <ind:state state_ref="state_gnome_screensaver_idle_delay" />
>     </ind:xmlfilecontent_test>
>     <ind:xmlfilecontent_object id="object_gnome_screensaver_idle_delay" version="1">
> -    <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath>
> -    <ind:xpath datatype="string" operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1]/default[1]/@value</ind:xpath>
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath>
>     </ind:xmlfilecontent_object>
> -  <ind:xmlfilecontent_state comment="idle timeout" id="state_gnome_screensaver_idle_delay" version="1">
> -    <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="inactivity_timeout_value" />
> +  <ind:xmlfilecontent_state comment="idle timeout"
> +  id="state_gnome_screensaver_idle_delay" version="1">
> +    <ind:value_of datatype="int" operation="less than or equal" var_check="all"
> +    var_ref="inactivity_timeout_value" />
>     </ind:xmlfilecontent_state>
> -  <external_variable comment="inactivity timeout variable" datatype="int" id="inactivity_timeout_value" version="1" />
> +  <external_variable comment="inactivity timeout variable" datatype="int"
> +  id="inactivity_timeout_value" version="1" />
>   </def-group>
> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
> index 06d3020..cc031fc 100644
> --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
> @@ -5,19 +5,23 @@
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>Idle activation of the screen lock should be enabled.</description>
> +      <description>Idle activation of the screen lock should be
> +      enabled.</description>
> +      <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
> +      <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
>         <criterion comment="screensaver lock is enabled" test_ref="test_screensaver_lock_enabled" />
>       </criteria>
>     </definition>
> -  <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="test_screensaver_lock_enabled" version="1">
> +  <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled"
> +  id="test_screensaver_lock_enabled" version="1">
>       <ind:object object_ref="object_screensaver_lock_enabled" />
>       <ind:state state_ref="state_screensaver_lock_enabled" />
>     </ind:xmlfilecontent_test>
>     <ind:xmlfilecontent_object id="object_screensaver_lock_enabled" version="1">
> -    <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath>
> -    <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/default[1]/@value</ind:xpath>
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath>
>     </ind:xmlfilecontent_object>
>     <ind:xmlfilecontent_state id="state_screensaver_lock_enabled" version="1">
>       <ind:value_of datatype="string">true</ind:value_of>
> diff --git a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
> index 7cad7cd..8229d71 100644
> --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
> @@ -6,12 +6,16 @@
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
>         <description>The screen saver should be blank.</description>
> +      <reference source="MED" ref_id="20131125" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
> +      <extend_definition comment="GConf2 installed" definition_ref="package_GConf2_installed" negate="true" />
>         <criterion comment="gnome screensaver set to blank screen" test_ref="test_gnome_screensaver_mode" />
>       </criteria>
>     </definition>
> -  <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="test_gnome_screensaver_mode" version="1">
> +  <ind:xmlfilecontent_test check="all"
> +  comment="gnome screensaver set to blank screen"
> +  id="test_gnome_screensaver_mode" version="1">
>       <ind:object object_ref="object_gnome_screensaver_mode" />
>       <ind:state state_ref="state_gnome_screensaver_mode" />
>     </ind:xmlfilecontent_test>
> @@ -19,7 +23,7 @@
>       <ind:value_of datatype="string">blank-only</ind:value_of>
>     </ind:xmlfilecontent_state>
>     <ind:xmlfilecontent_object id="object_gnome_screensaver_mode" version="1">
> -    <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath>
> -    <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/stringvalue[1]/text()</ind:xpath>
> +    <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
> +    <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
>     </ind:xmlfilecontent_object>
>   </def-group>
> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml b/RHEL6/input/checks/package_GConf2_installed.xml
> new file mode 100644
> index 0000000..032d76b
> --- /dev/null
> +++ b/RHEL6/input/checks/package_GConf2_installed.xml
> @@ -0,0 +1,26 @@
> +<def-group>
> + <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
> +  <definition class="compliance" id="package_GConf2_installed"
> +  version="1">
> +    <metadata>
> +      <title>Package GConf2 Installed</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <description>The RPM package GConf2 should be installed.</description>
> +      <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
> +    </metadata>	
> +    <criteria>
> +      <criterion comment="package GConf2 is installed"
> +      test_ref="test_package_GConf2_installed" />
> +    </criteria>
> +  </definition>
> +  <linux:rpminfo_test check="all" check_existence="all_exist"
> +  id="test_package_GConf2_installed" version="1"
> +  comment="package GConf2 is installed">
> +    <linux:object object_ref="obj_package_GConf2_installed" />
> +  </linux:rpminfo_test>
> +  <linux:rpminfo_object id="obj_package_GConf2_installed" version="1">
> +    <linux:name>GConf2</linux:name>
> +  </linux:rpminfo_object>
> +</def-group>
> diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv
> index 990f332..d956daa 100644
> --- a/RHEL6/input/checks/templates/packages_installed.csv
> +++ b/RHEL6/input/checks/templates/packages_installed.csv
> @@ -1,6 +1,7 @@
>   aide
>   audit
>   cronie
> +GConf2
>   iptables
>   iptables-ipv6
>   irqbalance
> diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh b/RHEL6/input/fixes/bash/package_GConf2_installed.sh
> new file mode 100644
> index 0000000..02c8768
> --- /dev/null
> +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh
> @@ -0,0 +1 @@
> +yum -y install GConf2



More information about the scap-security-guide mailing list