[PATCH] allow enable_gdm_login_banner to pass if gdm isn't installed

Paul Tittle (Contractor) ptittle at cmf.nrl.navy.mil
Fri Apr 25 15:34:07 UTC 2014


Maura,

That's a good observation. However, I have run across a use-case where 
GConf2 is installed but gdm isn't: you can have vnc sessions that use 
gnome-session. The other gconf checks are needed for that machine, but 
the gdm one isn't. So I think it may be necessary to have a separate gdm 
package check.

On 4/25/14 11:17 AM, Maura Dailey wrote:
> I have an open question that you and others can weigh in on. Should we 
> introduce a new check, package_gdm_installed? Or is it sufficient to 
> rely on the existing check GConf2, which has gdm as a dependency? I 
> had this dilemma when I submitted the other more closely related 
> GConf2 dependent checks, which is why I skipped the gui banner check.
>
> - Maura Dailey
>
> On 04/25/2014 10:47 AM, Paul Tittle wrote:
>> ---
>>   RHEL/6/input/checks/banner_gui_enabled.xml         |    3 +-
>>   RHEL/6/input/checks/package_gdm_installed.xml      |   26 
>> ++++++++++++++++++++
>>   .../input/checks/templates/packages_installed.csv  |    1 +
>>   RHEL/6/input/fixes/bash/package_gdm_installed.sh   |    1 +
>>   4 files changed, 30 insertions(+), 1 deletions(-)
>>   create mode 100644 RHEL/6/input/checks/package_gdm_installed.xml
>>   create mode 100644 RHEL/6/input/fixes/bash/package_gdm_installed.sh
>>
>> diff --git a/RHEL/6/input/checks/banner_gui_enabled.xml 
>> b/RHEL/6/input/checks/banner_gui_enabled.xml
>> index a6c147c..4be3183 100644
>> --- a/RHEL/6/input/checks/banner_gui_enabled.xml
>> +++ b/RHEL/6/input/checks/banner_gui_enabled.xml
>> @@ -8,7 +8,8 @@
>>         <description>Enable the GUI warning banner.</description>
>>         <reference source="rmercer" ref_id="20131104" 
>> ref_url="test_attestation" />
>>       </metadata>
>> -    <criteria>
>> +    <criteria operator="OR">
>> +      <extend_definition comment="gdm installed" 
>> definition_ref="package_gdm_installed" negate="true" />
>>         <criterion comment="check settings" 
>> test_ref="test_banner_gui_enabled" />
>>       </criteria>
>>     </definition>
>> diff --git a/RHEL/6/input/checks/package_gdm_installed.xml 
>> b/RHEL/6/input/checks/package_gdm_installed.xml
>> new file mode 100644
>> index 0000000..b9ea21f
>> --- /dev/null
>> +++ b/RHEL/6/input/checks/package_gdm_installed.xml
>> @@ -0,0 +1,26 @@
>> +<def-group>
>> + <!-- THIS FILE IS GENERATED by create_package_installed.py.  DO NOT 
>> EDIT.  -->
>> +  <definition class="compliance" id="package_gdm_installed"
>> +  version="1">
>> +    <metadata>
>> +      <title>Package gdm Installed</title>
>> +      <affected family="unix">
>> +        <platform>Red Hat Enterprise Linux 6</platform>
>> +      </affected>
>> +      <description>The RPM package gdm should be 
>> installed.</description>
>> +      <reference source="swells" ref_id="20130829" 
>> ref_url="test_attestation"/>
>> +    </metadata>
>> +    <criteria>
>> +      <criterion comment="package gdm is installed"
>> +      test_ref="test_package_gdm_installed" />
>> +    </criteria>
>> +  </definition>
>> +  <linux:rpminfo_test check="all" check_existence="all_exist"
>> +  id="test_package_gdm_installed" version="1"
>> +  comment="package gdm is installed">
>> +    <linux:object object_ref="obj_package_gdm_installed" />
>> +  </linux:rpminfo_test>
>> +  <linux:rpminfo_object id="obj_package_gdm_installed" version="1">
>> +    <linux:name>gdm</linux:name>
>> +  </linux:rpminfo_object>
>> +</def-group>
>> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv 
>> b/RHEL/6/input/checks/templates/packages_installed.csv
>> index 6dfc406..ef6e737 100644
>> --- a/RHEL/6/input/checks/templates/packages_installed.csv
>> +++ b/RHEL/6/input/checks/templates/packages_installed.csv
>> @@ -2,6 +2,7 @@ aide
>>   audit
>>   cronie
>>   GConf2
>> +gdm
>>   iptables
>>   iptables-ipv6
>>   irqbalance
>> diff --git a/RHEL/6/input/fixes/bash/package_gdm_installed.sh 
>> b/RHEL/6/input/fixes/bash/package_gdm_installed.sh
>> new file mode 100644
>> index 0000000..b5025fa
>> --- /dev/null
>> +++ b/RHEL/6/input/fixes/bash/package_gdm_installed.sh
>> @@ -0,0 +1 @@
>> +yum -y install gdm
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list