SSG 0.1-14-14 - set_screensaver_inactivity_timeout

Maura Dailey maura at eclipse.ncsc.mil
Tue Feb 18 17:27:06 UTC 2014


On 02/14/2014 02:17 PM, ssg fthfth wrote:
> For SSGID Set GNOME Login Inactivity Timeout - (CCE-26828-4), with either the stig-rhel6-server or usgcb-rhel6-server profiles selected from the SCAP stream, when run with SCC 3.1.1.1, may produce a false-positive on a RHEL6V1R2 complaint machine..
> With the X Window System not installed, the configuration check will fail.   Recommend verifying if a windowing system is installed, then, if applicable, check the configuration.
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

The check is essentially structured as: (Is GConf Installed? Negate 
value.) OR (Is the GConf setting applied?)


The truth table is as follows:

Pass        GConf Installed? (Negated): No        GConf Value Set?: Yes
Fail        GConf Installed? (Negated): No        GConf Value Set?: No
Pass        GConf Installed? (Negated): Yes        GConf Value Set?: Yes
Pass        GConf Installed? (Negated): Yes        GConf Value Set?: No

Assuming I am reading this bug report/warning correctly, the false 
positive probably refers to the last line, when GConf is not installed, 
and the value is not set. Obviously, the meaning is still correct (users 
should pass, because there is no utility that will even read the config 
file). Is this a problem? There are several other checks that use the 
same structure.

- Maura Dailey


More information about the scap-security-guide mailing list