Handling dconf Settings

Shawn Wells shawn at redhat.com
Mon Feb 24 23:18:38 UTC 2014


On 2/24/14, 6:07 PM, Maura Dailey wrote:
> The GConf settings we've been using for login banners and disabling 
> user lists have been replaced by Gnome 3's dconf parameters in RHEL 7 
> (and Fedora, obviously). dconf allows users and admins to set certain 
> parameters with plain text key files. It also allows admins to bypass 
> key files and set parameters with a GVariant binary blob file. There 
> are some problems for us with both methods. I'll use the login banner 
> text settings as an example.
>
> The recommended method in the RHEL 7 administration guide is to create 
> a text file in /etc/dconf/db/gdm.d/ that looks something like the 
> following:
>
> [org/gnome/login-screen]
> banner-message-enable=true
> banner-message-text='Consent banner text'
>
> After creating this file, the user must type dconf update, and the 
> settings are applied, making this a two step process. However, there 
> is a second way to apply the same settings, using the gsettings tool, 
> which will write the data as a binary data blob into the home 
> directory of whatever user runs the tool:
>
> sudo -u gdm dbus-launch gsettings set org.gnome.login-screen 
> banner-message-enable true
>
> This achieves the same effect and the consent banner will be displayed 
> to users in exactly the same way. This method is harder to test, since 
> there is no parseable text file for OVAL to evaluate, but it is 
> extremely easy to apply on the command line.
>
>
> TLDR: Are we allowed to mandate that system administrators must use 
> the Red Hat guide's method of using plain text key files?

dconf is verifiable, `gdm dbus-launch` is not. Seems reasonable to 
recommend implementations which can be machine verified.

Perhaps we could acknowledge the dbus-launch method in the description 
tag, noting that machines configured in such a way may report false 
positives (and to use dconf if this bothers the sysadmin)


> On a related note, the login banner text only displays AFTER users 
> have put in their user name, and there appears to be no way to edit 
> the consent banner's appearance without altering the GDM theme. 
> Instead, it's scrunched into a tiny window, with tiny grey text on a 
> grey background, with a scroll bar. Is it too late to put this on my 
> RHEL 7 final release wish list or can someone point me to the correct 
> settings?

File an RFE ASAP:
https://access.redhat.com/support/cases/new/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140224/7f43c0e9/attachment.html>


More information about the scap-security-guide mailing list