[PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). (UNCLASSIFIED)

Maura Dailey maura at eclipse.ncsc.mil
Fri Dec 27 18:04:19 UTC 2013


My local copy reports that it's correctly looking at gconf.xml.mandatory 
for all 4 listed checks, git diff comes back clean, and I only have one 
pending patch that I know about (fixing up some missing service and 
package checks). If someone else could confirm that there's a problem, I 
could reclone everything and try again.

- Maura Dailey

On 12/26/2013 02:07 PM, Shaw, Ray V CTR USARMY ARL (US) wrote:
> Classification: UNCLASSIFIED
> Caveats: NONE
>
> [Sorry for the delayed response, especially since I'm pretty sure I opened the BZ; I've been stupidly busy at work.]
>
> The checks still seem to be looking at gconf.xml.defaults for:
>
> gconf_gnome_screensaver_idle_activation_enabled.xml
> gconf_gnome_screensaver_idle_delay.xml
> gconf_gnome_screensaver_lock_enabled.xml
> gconf_gnome_screensaver_mode_blank.xml
>
> Did something go awry with part of this patch?  I do see the commit in the git log, and the "thumbnailers" check is looking at gconf.xml.mandatory.
>
> --
> Ray Shaw (Contractor, STG)
> Army Research Laboratory
> CIO, Unix Support
>
>
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Maura Dailey
> Sent: Monday, December 16, 2013 12:07 PM
> To: scap-security-guide at lists.fedorahosted.org
> Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults).
>
> I pushed it!
>
> - Maura Dailey
>
> On 12/16/2013 11:59 AM, Shawn Wells wrote:
>> On 12/16/13, 11:43 AM, Maura Dailey wrote:
>>> I've been out sick, but I noticed that no one seems to have looked at
>>> this one. Let me know if I can push this or if I need to change
>>> something.
>>>
>>> Thanks,
>>> Maura Dailey
>>>
>>> On 11/25/2013 04:02 PM, Maura Dailey wrote:
>>>> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
>>>> ---
>>>>    .../input/checks/gconf_gnome_disable_automount.xml |   59
>>>> +++++++++++---------
>>>>    .../checks/gconf_gnome_disable_thumbnailers.xml    |   34 ++++++-----
>>>>    ...f_gnome_screensaver_idle_activation_enabled.xml |   19 ++++--
>>>>    .../checks/gconf_gnome_screensaver_idle_delay.xml  |   24 +++++---
>>>>    .../gconf_gnome_screensaver_lock_enabled.xml       |   14 +++--
>>>>    .../checks/gconf_gnome_screensaver_mode_blank.xml  |   12 +++-
>>>>    RHEL6/input/checks/package_GConf2_installed.xml    |   26 +++++++++
>>>>    .../input/checks/templates/packages_installed.csv  |    1 +
>>>>    RHEL6/input/fixes/bash/package_GConf2_installed.sh |    1 +
>>>>    9 files changed, 124 insertions(+), 66 deletions(-)
>>>>    create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml
>>>>    create mode 100644
>>>> RHEL6/input/fixes/bash/package_GConf2_installed.sh
>>>>
>>>> diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml
>>>> b/RHEL6/input/checks/gconf_gnome_disable_automount.xml
>>>> index e2e7efc..f78fc89 100644
>>>> --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml
>>>> +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml
>>>> @@ -1,41 +1,46 @@
>>>>    <def-group>
>>>> -  <definition class="compliance"
>>>> -  id="gconf_gnome_disable_automount" version="1">
>>>> +  <definition class="compliance" id="gconf_gnome_disable_automount"
>>>> version="1">
>>>>        <metadata>
>>>>          <title>Disable GNOME Automounting</title>
>>>>          <affected family="unix">
>>>>            <platform>Red Hat Enterprise Linux 6</platform>
>>>>          </affected>
>>>> -      <description>The system's default desktop environment, GNOME,
>>>> will mount devices and removable media (such as DVDs, CDs and USB
>>>> flash drives) whenever they are inserted into the system.  Disable
>>>> automount and autorun within GNOME.</description>
>>>> +      <description>The system's default desktop environment, GNOME,
>>>> will mount
>>>> +      devices and removable media (such as DVDs, CDs and USB flash
>>>> drives)
>>>> +      whenever they are inserted into the system. Disable automount
>>>> and autorun
>>>> +      within GNOME.</description>
>>>> +      <reference source="MED" ref_id="20131125"
>>>> ref_url="test_attestation" />
>>>>        </metadata>
>>>> -    <criteria operator="AND">
>>>> +    <criteria operator="OR">
>>>> +      <extend_definition comment="GConf2 installed"
>>>> definition_ref="package_GConf2_installed" negate="true" />
>>>>          <criterion comment="Disable automount in GNOME"
>>>> test_ref="test_gconf_gnome_disable_automount" />
>>>> -      <criterion comment="Disable autorun in GNOME"
>>>> test_ref="test_gconf_gnome_disable_automount_autorun" />
>>>> +      <criterion comment="Disable autorun in GNOME"
>>>> test_ref="test_gconf_gnome_disable_automount_autorun" />
>>>>        </criteria>
>>>>      </definition>
>>>> -
>>>> -  <ind:textfilecontent54_test check="all" check_existence="all_exist"
>>>> -  comment="Disable automount in GNOME"
>>>> -  id="test_gconf_gnome_disable_automount" version="1">
>>>> +  <ind:xmlfilecontent_test check="all" check_existence="all_exist"
>>>> +  comment="Disable automount in GNOME"
>>>> id="test_gconf_gnome_disable_automount"
>>>> +  version="1">
>>>>        <ind:object object_ref="obj_gconf_gnome_disable_automount" />
>>>> -  </ind:textfilecontent54_test>
>>>> -  <ind:textfilecontent54_object
>>>> id="obj_gconf_gnome_disable_automount" version="1">
>>>> -
>>>> <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path>
>>>> -    <ind:filename>%gconf.xml</ind:filename>
>>>> -    <ind:pattern operation="pattern
>>>> match">^\s*.entry\s+name="media_automount"\s+mtime="\d+"\s+type="bool"\s+value="false"\/.$</ind:pattern>
>>>> -    <ind:instance datatype="int">1</ind:instance>
>>>> -  </ind:textfilecontent54_object>
>>>> -
>>>> -  <ind:textfilecontent54_test check="all" check_existence="all_exist"
>>>> -  comment="Disable autorun in GNOME"
>>>> +    <ind:state state_ref="state_gconf_gnome_disable_automount" />
>>>> + </ind:xmlfilecontent_test>  <ind:xmlfilecontent_state
>>>> id="state_gconf_gnome_disable_automount" version="1">
>>>> +    <ind:value_of datatype="string">false</ind:value_of>
>>>> +  </ind:xmlfilecontent_state>
>>>> +  <ind:xmlfilecontent_object id="obj_gconf_gnome_disable_automount"
>>>> version="1">
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc
>>>> es/%gconf.xml</ind:filepath>
>>>> + <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath
>>>> + >
>>>> +  </ind:xmlfilecontent_object>
>>>> +  <ind:xmlfilecontent_test check="all" check_existence="all_exist"
>>>> +  comment="Disable autorun in GNOME"
>>>>      id="test_gconf_gnome_disable_automount_autorun" version="1">
>>>>        <ind:object
>>>> object_ref="obj_gconf_gnome_disable_automount_autorun" />
>>>> -  </ind:textfilecontent54_test>
>>>> -  <ind:textfilecontent54_object
>>>> id="obj_gconf_gnome_disable_automount_autorun" version="1">
>>>> -
>>>> <ind:path>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences</ind:path>
>>>> -    <ind:filename>%gconf.xml</ind:filename>
>>>> -    <ind:pattern operation="pattern
>>>> match">^\s*.entry\s+name="media_autorun_never"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern>
>>>> -    <ind:instance datatype="int">1</ind:instance>
>>>> -  </ind:textfilecontent54_object>
>>>> -
>>>> +    <ind:state
>>>> state_ref="state_gconf_gnome_disable_automount_autorun" />
>>>> +  </ind:xmlfilecontent_test>
>>>> +  <ind:xmlfilecontent_state
>>>> id="state_gconf_gnome_disable_automount_autorun" version="1">
>>>> +    <ind:value_of datatype="string">true</ind:value_of>
>>>> +  </ind:xmlfilecontent_state>
>>>> +  <ind:xmlfilecontent_object
>>>> id="obj_gconf_gnome_disable_automount_autorun" version="1">
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc
>>>> es/%gconf.xml</ind:filepath>
>>>> +
>>>> <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpa
>>>> th>
>>>> +  </ind:xmlfilecontent_object>
>>>>    </def-group>
>>>> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
>>>> b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
>>>> index 72bf086..80045a3 100644
>>>> --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
>>>> +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
>>>> @@ -1,28 +1,32 @@
>>>>    <def-group>
>>>> -  <definition class="compliance"
>>>> -  id="gconf_gnome_disable_thumbnailers" version="1">
>>>> +  <definition class="compliance"
>>>> id="gconf_gnome_disable_thumbnailers" version="1">
>>>>        <metadata>
>>>>          <title>Disable All GNOME Thumbnailers</title>
>>>>          <affected family="unix">
>>>>            <platform>Red Hat Enterprise Linux 6</platform>
>>>>          </affected>
>>>> -      <description>The system's default desktop environment, GNOME,
>>>> uses a number of different thumbnailer programs to generate
>>>> thumbnails for any new or modified content in an opened folder.
>>>> Disable the execution of these thumbnail applications within
>>>> GNOME.</description>
>>>> +      <description>The system's default desktop environment, GNOME,
>>>> uses a
>>>> +      number of different thumbnailer programs to generate
>>>> thumbnails for any
>>>> +      new or modified content in an opened folder. Disable the
>>>> execution of
>>>> +      these thumbnail applications within GNOME.</description>
>>>> +      <reference source="MED" ref_id="20131125"
>>>> ref_url="test_attestation" />
>>>>        </metadata>
>>>> -    <criteria>
>>>> +    <criteria operator="OR">
>>>> +      <extend_definition comment="GConf2 installed"
>>>> definition_ref="package_GConf2_installed" negate="true" />
>>>>          <criterion comment="Disable thumbnailers in GNOME"
>>>> test_ref="test_gconf_gnome_disable_thumbnailers" />
>>>>        </criteria>
>>>>      </definition>
>>>> -
>>>> -  <ind:textfilecontent54_test check="all" check_existence="none_exist"
>>>> -  comment="Disable thumbnailers in GNOME"
>>>> +  <ind:xmlfilecontent_test check="all" check_existence="all_exist"
>>>> +  comment="Disable thumbnailers in GNOME"
>>>>      id="test_gconf_gnome_disable_thumbnailers" version="1">
>>>>        <ind:object object_ref="obj_gconf_gnome_disable_thumbnailers"
>>>> />
>>>> -  </ind:textfilecontent54_test>
>>>> -  <ind:textfilecontent54_object
>>>> id="obj_gconf_gnome_disable_thumbnailers" version="1">
>>>> -
>>>> <ind:path>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers</ind:path>
>>>> -    <ind:filename>%gconf.xml</ind:filename>
>>>> -    <ind:pattern operation="pattern
>>>> match">^\s*.entry\s+name="disable_all"\s+mtime="\d+"\s+type="bool"\s+value="true"\/.$</ind:pattern>
>>>> -    <ind:instance datatype="int">1</ind:instance>
>>>> -  </ind:textfilecontent54_object>
>>>> -
>>>> +    <ind:state state_ref="state_gconf_gnome_disable_thumbnailers"
>>>> + />  </ind:xmlfilecontent_test>  <ind:xmlfilecontent_state
>>>> id="state_gconf_gnome_disable_thumbnailers" version="1">
>>>> +    <ind:value_of datatype="string">true</ind:value_of>
>>>> +  </ind:xmlfilecontent_state>
>>>> +  <ind:xmlfilecontent_object
>>>> id="obj_gconf_gnome_disable_thumbnailers" version="1">
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnail
>>>> ers/%gconf.xml</ind:filepath>
>>>> + <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath>
>>>> +  </ind:xmlfilecontent_object>
>>>>    </def-group>
>>>> diff --git
>>>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled
>>>> .xml
>>>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled
>>>> .xml
>>>>
>>>> index 5776014..0d012a7 100644
>>>> ---
>>>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled
>>>> .xml
>>>>
>>>> +++
>>>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled
>>>> .xml
>>>>
>>>> @@ -5,21 +5,26 @@
>>>>          <affected family="unix">
>>>>            <platform>Red Hat Enterprise Linux 6</platform>
>>>>          </affected>
>>>> -      <description>Idle activation of the screen saver should be
>>>> enabled.</description>
>>>> +      <description>Idle activation of the screen saver should be
>>>> +      enabled.</description>
>>>> +      <reference source="MED" ref_id="20131125"
>>>> ref_url="test_attestation" />
>>>>        </metadata>
>>>> -    <criteria>
>>>> +    <criteria operator="OR">
>>>> +      <extend_definition comment="GConf2 installed"
>>>> definition_ref="package_GConf2_installed" negate="true" />
>>>>          <criterion comment="gnome screensaver is activated on idle"
>>>> test_ref="test_gnome_screensaver_idle_activated" />
>>>>        </criteria>
>>>>      </definition>
>>>> -  <ind:xmlfilecontent_test check="all" comment="gnome screensaver
>>>> is activated on idle" id="test_gnome_screensaver_idle_activated"
>>>> version="1">
>>>> +  <ind:xmlfilecontent_test check="all"
>>>> +  comment="gnome screensaver is activated on idle"
>>>> +  id="test_gnome_screensaver_idle_activated" version="1">
>>>>        <ind:object
>>>> object_ref="object_gnome_screensaver_idle_activated" />
>>>> -    <ind:state state_ref="state_activated_on_idle" />
>>>> +    <ind:state state_ref="state_gnome_screensaver_idle_activated"
>>>> + />
>>>>      </ind:xmlfilecontent_test>
>>>> -  <ind:xmlfilecontent_state id="state_activated_on_idle"
>>>> version="1">
>>>> +  <ind:xmlfilecontent_state
>>>> id="state_gnome_screensaver_idle_activated" version="1">
>>>>        <ind:value_of datatype="string">true</ind:value_of>
>>>>      </ind:xmlfilecontent_state>
>>>>      <ind:xmlfilecontent_object
>>>> id="object_gnome_screensaver_idle_activated" version="1">
>>>> -
>>>> <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil
>>>> epath>
>>>> -
>>>> <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='
>>>> gnome-screensaver']/entry[@name='idle_activation_enabled']/local_sch
>>>> ema[1]/default[1]/@value</ind:xpath>
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/
>>>> %gconf.xml</ind:filepath>
>>>> +
>>>> <ind:xpath>/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath>
>>>>      </ind:xmlfilecontent_object>
>>>>    </def-group>
>>>> diff --git
>>>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
>>>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
>>>> index 70cc1c2..c77e608 100644
>>>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
>>>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml
>>>> @@ -5,22 +5,30 @@
>>>>          <affected family="unix">
>>>>            <platform>Red Hat Enterprise Linux 6</platform>
>>>>          </affected>
>>>> -      <description>The allowed period of inactivity before the
>>>> screensaver is activated.</description>
>>>> +      <description>The allowed period of inactivity before the
>>>> screensaver is
>>>> +      activated.</description>
>>>> +      <reference source="MED" ref_id="20131125"
>>>> ref_url="test_attestation" />
>>>>        </metadata>
>>>> -    <criteria>
>>>> +    <criteria operator="OR">
>>>> +      <extend_definition comment="GConf2 installed"
>>>> definition_ref="package_GConf2_installed" negate="true" />
>>>>          <criterion comment="check value of idle_delay in GCONF"
>>>> test_ref="test_gnome_screensaver_idle_delay" />
>>>>        </criteria>
>>>>      </definition>
>>>> -  <ind:xmlfilecontent_test check="all" comment="test screensaver
>>>> timeout period" id="test_gnome_screensaver_idle_delay" version="1">
>>>> +  <ind:xmlfilecontent_test check="all"
>>>> +  comment="test screensaver timeout period"
>>>> +  id="test_gnome_screensaver_idle_delay" version="1">
>>>>        <ind:object object_ref="object_gnome_screensaver_idle_delay" />
>>>>        <ind:state state_ref="state_gnome_screensaver_idle_delay" />
>>>>      </ind:xmlfilecontent_test>
>>>>      <ind:xmlfilecontent_object
>>>> id="object_gnome_screensaver_idle_delay" version="1">
>>>> -
>>>> <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:filepath>
>>>> -    <ind:xpath datatype="string"
>>>> operation="equals">/gconf/dir[@name='schemas']/dir[@name='apps']/dir
>>>> [@name='gnome-screensaver']/entry[@name='idle_delay']/local_schema[1
>>>> ]/default[1]/@value</ind:xpath>
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/
>>>> %gconf.xml</ind:filepath>
>>>> + <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath>
>>>>      </ind:xmlfilecontent_object>
>>>> -  <ind:xmlfilecontent_state comment="idle timeout"
>>>> id="state_gnome_screensaver_idle_delay" version="1">
>>>> -    <ind:value_of datatype="int" operation="less than or equal"
>>>> var_check="all" var_ref="inactivity_timeout_value" />
>>>> +  <ind:xmlfilecontent_state comment="idle timeout"
>>>> +  id="state_gnome_screensaver_idle_delay" version="1">
>>>> +    <ind:value_of datatype="int" operation="less than or equal"
>>>> var_check="all"
>>>> +    var_ref="inactivity_timeout_value" />
>>>>      </ind:xmlfilecontent_state>
>>>> -  <external_variable comment="inactivity timeout variable"
>>>> datatype="int" id="inactivity_timeout_value" version="1" />
>>>> +  <external_variable comment="inactivity timeout variable"
>>>> datatype="int"
>>>> +  id="inactivity_timeout_value" version="1" />
>>>>    </def-group>
>>>> diff --git
>>>> a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
>>>> b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
>>>> index 06d3020..cc031fc 100644
>>>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
>>>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml
>>>> @@ -5,19 +5,23 @@
>>>>          <affected family="unix">
>>>>            <platform>Red Hat Enterprise Linux 6</platform>
>>>>          </affected>
>>>> -      <description>Idle activation of the screen lock should be
>>>> enabled.</description>
>>>> +      <description>Idle activation of the screen lock should be
>>>> +      enabled.</description>
>>>> +      <reference source="MED" ref_id="20131125"
>>>> ref_url="test_attestation" />
>>>>        </metadata>
>>>> -    <criteria>
>>>> +    <criteria operator="OR">
>>>> +      <extend_definition comment="GConf2 installed"
>>>> definition_ref="package_GConf2_installed" negate="true" />
>>>>          <criterion comment="screensaver lock is enabled"
>>>> test_ref="test_screensaver_lock_enabled" />
>>>>        </criteria>
>>>>      </definition>
>>>> -  <ind:xmlfilecontent_test check="all" comment="screensaver lock is
>>>> enabled" id="test_screensaver_lock_enabled" version="1">
>>>> +  <ind:xmlfilecontent_test check="all" comment="screensaver lock is
>>>> enabled"
>>>> +  id="test_screensaver_lock_enabled" version="1">
>>>>        <ind:object object_ref="object_screensaver_lock_enabled" />
>>>>        <ind:state state_ref="state_screensaver_lock_enabled" />
>>>>      </ind:xmlfilecontent_test>
>>>>      <ind:xmlfilecontent_object id="object_screensaver_lock_enabled"
>>>> version="1">
>>>> -
>>>> <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil
>>>> epath>
>>>> -
>>>> <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='
>>>> gnome-screensaver']/entry[@name='lock_enabled']/local_schema[1]/defa
>>>> ult[1]/@value</ind:xpath>
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/
>>>> %gconf.xml</ind:filepath>
>>>> + <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath>
>>>>      </ind:xmlfilecontent_object>
>>>>      <ind:xmlfilecontent_state id="state_screensaver_lock_enabled"
>>>> version="1">
>>>>        <ind:value_of datatype="string">true</ind:value_of>
>>>> diff --git
>>>> a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
>>>> b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
>>>> index 7cad7cd..8229d71 100644
>>>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
>>>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml
>>>> @@ -6,12 +6,16 @@
>>>>            <platform>Red Hat Enterprise Linux 6</platform>
>>>>          </affected>
>>>>          <description>The screen saver should be blank.</description>
>>>> +      <reference source="MED" ref_id="20131125"
>>>> ref_url="test_attestation" />
>>>>        </metadata>
>>>> -    <criteria>
>>>> +    <criteria operator="OR">
>>>> +      <extend_definition comment="GConf2 installed"
>>>> definition_ref="package_GConf2_installed" negate="true" />
>>>>          <criterion comment="gnome screensaver set to blank screen"
>>>> test_ref="test_gnome_screensaver_mode" />
>>>>        </criteria>
>>>>      </definition>
>>>> -  <ind:xmlfilecontent_test check="all" comment="gnome screensaver
>>>> set to blank screen" id="test_gnome_screensaver_mode" version="1">
>>>> +  <ind:xmlfilecontent_test check="all"
>>>> +  comment="gnome screensaver set to blank screen"
>>>> +  id="test_gnome_screensaver_mode" version="1">
>>>>        <ind:object object_ref="object_gnome_screensaver_mode" />
>>>>        <ind:state state_ref="state_gnome_screensaver_mode" />
>>>>      </ind:xmlfilecontent_test>
>>>> @@ -19,7 +23,7 @@
>>>>        <ind:value_of datatype="string">blank-only</ind:value_of>
>>>>      </ind:xmlfilecontent_state>
>>>>      <ind:xmlfilecontent_object id="object_gnome_screensaver_mode"
>>>> version="1">
>>>> -
>>>> <ind:filepath>/etc/gconf/gconf.xml.defaults/%gconf-tree.xml</ind:fil
>>>> epath>
>>>> -
>>>> <ind:xpath>/gconf/dir[@name='schemas']/dir[@name='apps']/dir[@name='
>>>> gnome-screensaver']/entry[@name='mode']/local_schema[1]/default[1]/s
>>>> tringvalue[1]/text()</ind:xpath>
>>>> +
>>>> <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/
>>>> %gconf.xml</ind:filepath>
>>>> +
>>>> <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
>>>>      </ind:xmlfilecontent_object>
>>>>    </def-group>
>>>> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml
>>>> b/RHEL6/input/checks/package_GConf2_installed.xml
>>>> new file mode 100644
>>>> index 0000000..032d76b
>>>> --- /dev/null
>>>> +++ b/RHEL6/input/checks/package_GConf2_installed.xml
>>>> @@ -0,0 +1,26 @@
>>>> +<def-group>
>>>> + <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO
>>>> NOT EDIT.  -->
>>>> +  <definition class="compliance" id="package_GConf2_installed"
>>>> +  version="1">
>>>> +    <metadata>
>>>> +      <title>Package GConf2 Installed</title>
>>>> +      <affected family="unix">
>>>> +        <platform>Red Hat Enterprise Linux 6</platform>
>>>> +      </affected>
>>>> +      <description>The RPM package GConf2 should be
>>>> installed.</description>
>>>> +      <reference source="swells" ref_id="20130829"
>>>> ref_url="test_attestation"/>
>>>> +    </metadata>
>>>> +    <criteria>
>>>> +      <criterion comment="package GConf2 is installed"
>>>> +      test_ref="test_package_GConf2_installed" />
>>>> +    </criteria>
>>>> +  </definition>
>>>> +  <linux:rpminfo_test check="all" check_existence="all_exist"
>>>> +  id="test_package_GConf2_installed" version="1"
>>>> +  comment="package GConf2 is installed">
>>>> +    <linux:object object_ref="obj_package_GConf2_installed" />
>>>> +  </linux:rpminfo_test>
>>>> +  <linux:rpminfo_object id="obj_package_GConf2_installed" version="1">
>>>> +    <linux:name>GConf2</linux:name>
>>>> +  </linux:rpminfo_object>
>>>> +</def-group>
>>>> diff --git a/RHEL6/input/checks/templates/packages_installed.csv
>>>> b/RHEL6/input/checks/templates/packages_installed.csv
>>>> index 990f332..d956daa 100644
>>>> --- a/RHEL6/input/checks/templates/packages_installed.csv
>>>> +++ b/RHEL6/input/checks/templates/packages_installed.csv
>>>> @@ -1,6 +1,7 @@
>>>>    aide
>>>>    audit
>>>>    cronie
>>>> +GConf2
>>>>    iptables
>>>>    iptables-ipv6
>>>>    irqbalance
>>>> diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh
>>>> b/RHEL6/input/fixes/bash/package_GConf2_installed.sh
>>>> new file mode 100644
>>>> index 0000000..02c8768
>>>> --- /dev/null
>>>> +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh
>>>> @@ -0,0 +1 @@
>>>> +yum -y install GConf2
>> This is great! Ack.
>>
>> This tracks back to
>> https://bugzilla.redhat.com/show_bug.cgi?id=1043053. Give a shout
>> after you've pushed and I'll resolve the bug.
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> Classification: UNCLASSIFIED
> Caveats: NONE
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list