banner_gui_enabled.xml
Shawn Wells
shawn at redhat.com
Tue Nov 5 01:02:34 UTC 2013
On 11/4/13, 5:31 PM, Rodney L. Mercer wrote:
> I was seeing a fail on "Result for Enable GUI Warning Banner"
> CCE-27195-7.
>
> I found this ticket:
> https://fedorahosted.org/scap-security-guide/ticket/319
>
> So I worked on the banner_gui_enabled.xml file and came up with the
> attached replacement. I tested it and it appears to work correctly.
>
> Could someone check this to see if I have this right?
>
> Thanks,
> Rodney.
> ---------
>
> <def-group>
> <definition class="compliance" id="banner_gui_enabled" version="1">
> <metadata>
> <title>Enable GUI Warning Banner</title>
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> <description>Enable the GUI warning banner.</description>
> </metadata>
> <criteria>
> <criterion comment="check settings" test_ref="test_banner_gui_enabled" />
> </criteria>
> </definition>
> <ind:xmlfilecontent_test check="all" comment="stuff" id="test_banner_gui_enabled" version="1">
> <ind:object object_ref="object_banner_message_enable" />
> <ind:state state_ref="state_banner_message_enable" />
> </ind:xmlfilecontent_test>
> <ind:xmlfilecontent_object id="object_banner_message_enable" version="1">
> <ind:filepath>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
> <ind:xpath>/gconf/entry[@name='banner_message_enable']/@value</ind:xpath>
> </ind:xmlfilecontent_object>
> <ind:xmlfilecontent_state id="state_banner_message_enable" version="1">
> <ind:value_of datatype="string">true</ind:value_of>
> </ind:xmlfilecontent_state>
> </def-group>
There's a ton of goodness in this. Proper filepath, addition of the
state, filename->filepath conversion!
As for testing:
[root at SSG-RHEL6 checks]# sudo -u gdm gconftool-2 \
> --type bool \
> --set /apps/gdm/simple-greeter/banner_message_enable false
[root at SSG-RHEL6 checks]# ./testcheck.py banner_gui_enabled.xml
Evaluating with OVAL tempfile : /tmp/banner_gui_enabledzCPQAU.xml
Writing results to : /tmp/banner_gui_enabledzCPQAU.xml-results
Definition oval:scap-security-guide.testing:def:241: false
Evaluation done.
[root at SSG-RHEL6 checks]# sudo -u gdm gconftool-2 --type bool --set
/apps/gdm/simple-greeter/banner_message_enable true
[root at SSG-RHEL6 checks]# ./testcheck.py banner_gui_enabled.xml
Evaluating with OVAL tempfile : /tmp/banner_gui_enabled72tTqS.xml
Writing results to : /tmp/banner_gui_enabled72tTqS.xml-results
Definition oval:scap-security-guide.testing:def:241: true
Evaluation done.
Add OVAL signoff within the <metadata> tags and please resubmit for an
ACK, e.g.:
<reference source="rmercer" ref_id="20131104" ref_url="test_attestation" />
Nice work!
More information about the scap-security-guide
mailing list