[PATCH] allow enable_gdm_login_banner to pass if gdm isn't installed

Maura Dailey maura at eclipse.ncsc.mil
Fri Apr 25 15:17:58 UTC 2014


I have an open question that you and others can weigh in on. Should we 
introduce a new check, package_gdm_installed? Or is it sufficient to 
rely on the existing check GConf2, which has gdm as a dependency? I had 
this dilemma when I submitted the other more closely related GConf2 
dependent checks, which is why I skipped the gui banner check.

- Maura Dailey

On 04/25/2014 10:47 AM, Paul Tittle wrote:
> ---
>   RHEL/6/input/checks/banner_gui_enabled.xml         |    3 +-
>   RHEL/6/input/checks/package_gdm_installed.xml      |   26 ++++++++++++++++++++
>   .../input/checks/templates/packages_installed.csv  |    1 +
>   RHEL/6/input/fixes/bash/package_gdm_installed.sh   |    1 +
>   4 files changed, 30 insertions(+), 1 deletions(-)
>   create mode 100644 RHEL/6/input/checks/package_gdm_installed.xml
>   create mode 100644 RHEL/6/input/fixes/bash/package_gdm_installed.sh
>
> diff --git a/RHEL/6/input/checks/banner_gui_enabled.xml b/RHEL/6/input/checks/banner_gui_enabled.xml
> index a6c147c..4be3183 100644
> --- a/RHEL/6/input/checks/banner_gui_enabled.xml
> +++ b/RHEL/6/input/checks/banner_gui_enabled.xml
> @@ -8,7 +8,8 @@
>         <description>Enable the GUI warning banner.</description>
>         <reference source="rmercer" ref_id="20131104" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
> +      <extend_definition comment="gdm installed" definition_ref="package_gdm_installed" negate="true" />
>         <criterion comment="check settings" test_ref="test_banner_gui_enabled" />
>       </criteria>
>     </definition>
> diff --git a/RHEL/6/input/checks/package_gdm_installed.xml b/RHEL/6/input/checks/package_gdm_installed.xml
> new file mode 100644
> index 0000000..b9ea21f
> --- /dev/null
> +++ b/RHEL/6/input/checks/package_gdm_installed.xml
> @@ -0,0 +1,26 @@
> +<def-group>
> + <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT EDIT.  -->
> +  <definition class="compliance" id="package_gdm_installed"
> +  version="1">
> +    <metadata>
> +      <title>Package gdm Installed</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <description>The RPM package gdm should be installed.</description>
> +      <reference source="swells" ref_id="20130829" ref_url="test_attestation"/>
> +    </metadata>
> +    <criteria>
> +      <criterion comment="package gdm is installed"
> +      test_ref="test_package_gdm_installed" />
> +    </criteria>
> +  </definition>
> +  <linux:rpminfo_test check="all" check_existence="all_exist"
> +  id="test_package_gdm_installed" version="1"
> +  comment="package gdm is installed">
> +    <linux:object object_ref="obj_package_gdm_installed" />
> +  </linux:rpminfo_test>
> +  <linux:rpminfo_object id="obj_package_gdm_installed" version="1">
> +    <linux:name>gdm</linux:name>
> +  </linux:rpminfo_object>
> +</def-group>
> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv b/RHEL/6/input/checks/templates/packages_installed.csv
> index 6dfc406..ef6e737 100644
> --- a/RHEL/6/input/checks/templates/packages_installed.csv
> +++ b/RHEL/6/input/checks/templates/packages_installed.csv
> @@ -2,6 +2,7 @@ aide
>   audit
>   cronie
>   GConf2
> +gdm
>   iptables
>   iptables-ipv6
>   irqbalance
> diff --git a/RHEL/6/input/fixes/bash/package_gdm_installed.sh b/RHEL/6/input/fixes/bash/package_gdm_installed.sh
> new file mode 100644
> index 0000000..b5025fa
> --- /dev/null
> +++ b/RHEL/6/input/fixes/bash/package_gdm_installed.sh
> @@ -0,0 +1 @@
> +yum -y install gdm



More information about the scap-security-guide mailing list