[PATCH] allow enable_gdm_login_banner to pass if gdm isn't installed
Paul Tittle (Contractor)
ptittle at cmf.nrl.navy.mil
Tue Apr 29 16:59:03 UTC 2014
Thanks Maura. Pushed to master.
On 4/25/14 2:11 PM, Maura Dailey wrote:
> If you're run into this situation, however unusual, then your
> rationale makes sense to me. ACK.
>
> - Maura Dailey
>
> On 04/25/2014 11:34 AM, Paul Tittle (Contractor) wrote:
>> Maura,
>>
>> That's a good observation. However, I have run across a use-case
>> where GConf2 is installed but gdm isn't: you can have vnc sessions
>> that use gnome-session. The other gconf checks are needed for that
>> machine, but the gdm one isn't. So I think it may be necessary to
>> have a separate gdm package check.
>>
>> On 4/25/14 11:17 AM, Maura Dailey wrote:
>>> I have an open question that you and others can weigh in on. Should
>>> we introduce a new check, package_gdm_installed? Or is it sufficient
>>> to rely on the existing check GConf2, which has gdm as a dependency?
>>> I had this dilemma when I submitted the other more closely related
>>> GConf2 dependent checks, which is why I skipped the gui banner check.
>>>
>>> - Maura Dailey
>>>
>>> On 04/25/2014 10:47 AM, Paul Tittle wrote:
>>>> ---
>>>> RHEL/6/input/checks/banner_gui_enabled.xml | 3 +-
>>>> RHEL/6/input/checks/package_gdm_installed.xml | 26
>>>> ++++++++++++++++++++
>>>> .../input/checks/templates/packages_installed.csv | 1 +
>>>> RHEL/6/input/fixes/bash/package_gdm_installed.sh | 1 +
>>>> 4 files changed, 30 insertions(+), 1 deletions(-)
>>>> create mode 100644 RHEL/6/input/checks/package_gdm_installed.xml
>>>> create mode 100644 RHEL/6/input/fixes/bash/package_gdm_installed.sh
>>>>
>>>> diff --git a/RHEL/6/input/checks/banner_gui_enabled.xml
>>>> b/RHEL/6/input/checks/banner_gui_enabled.xml
>>>> index a6c147c..4be3183 100644
>>>> --- a/RHEL/6/input/checks/banner_gui_enabled.xml
>>>> +++ b/RHEL/6/input/checks/banner_gui_enabled.xml
>>>> @@ -8,7 +8,8 @@
>>>> <description>Enable the GUI warning banner.</description>
>>>> <reference source="rmercer" ref_id="20131104"
>>>> ref_url="test_attestation" />
>>>> </metadata>
>>>> - <criteria>
>>>> + <criteria operator="OR">
>>>> + <extend_definition comment="gdm installed"
>>>> definition_ref="package_gdm_installed" negate="true" />
>>>> <criterion comment="check settings"
>>>> test_ref="test_banner_gui_enabled" />
>>>> </criteria>
>>>> </definition>
>>>> diff --git a/RHEL/6/input/checks/package_gdm_installed.xml
>>>> b/RHEL/6/input/checks/package_gdm_installed.xml
>>>> new file mode 100644
>>>> index 0000000..b9ea21f
>>>> --- /dev/null
>>>> +++ b/RHEL/6/input/checks/package_gdm_installed.xml
>>>> @@ -0,0 +1,26 @@
>>>> +<def-group>
>>>> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO
>>>> NOT EDIT. -->
>>>> + <definition class="compliance" id="package_gdm_installed"
>>>> + version="1">
>>>> + <metadata>
>>>> + <title>Package gdm Installed</title>
>>>> + <affected family="unix">
>>>> + <platform>Red Hat Enterprise Linux 6</platform>
>>>> + </affected>
>>>> + <description>The RPM package gdm should be
>>>> installed.</description>
>>>> + <reference source="swells" ref_id="20130829"
>>>> ref_url="test_attestation"/>
>>>> + </metadata>
>>>> + <criteria>
>>>> + <criterion comment="package gdm is installed"
>>>> + test_ref="test_package_gdm_installed" />
>>>> + </criteria>
>>>> + </definition>
>>>> + <linux:rpminfo_test check="all" check_existence="all_exist"
>>>> + id="test_package_gdm_installed" version="1"
>>>> + comment="package gdm is installed">
>>>> + <linux:object object_ref="obj_package_gdm_installed" />
>>>> + </linux:rpminfo_test>
>>>> + <linux:rpminfo_object id="obj_package_gdm_installed" version="1">
>>>> + <linux:name>gdm</linux:name>
>>>> + </linux:rpminfo_object>
>>>> +</def-group>
>>>> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv
>>>> b/RHEL/6/input/checks/templates/packages_installed.csv
>>>> index 6dfc406..ef6e737 100644
>>>> --- a/RHEL/6/input/checks/templates/packages_installed.csv
>>>> +++ b/RHEL/6/input/checks/templates/packages_installed.csv
>>>> @@ -2,6 +2,7 @@ aide
>>>> audit
>>>> cronie
>>>> GConf2
>>>> +gdm
>>>> iptables
>>>> iptables-ipv6
>>>> irqbalance
>>>> diff --git a/RHEL/6/input/fixes/bash/package_gdm_installed.sh
>>>> b/RHEL/6/input/fixes/bash/package_gdm_installed.sh
>>>> new file mode 100644
>>>> index 0000000..b5025fa
>>>> --- /dev/null
>>>> +++ b/RHEL/6/input/fixes/bash/package_gdm_installed.sh
>>>> @@ -0,0 +1 @@
>>>> +yum -y install gdm
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list