Handling dconf Settings
Steve Grubb
sgrubb at redhat.com
Tue Feb 25 16:11:18 UTC 2014
On Monday, February 24, 2014 06:41:08 PM Steve Grubb wrote:
> On Monday, February 24, 2014 06:07:22 PM Maura Dailey wrote:
> > The GConf settings we've been using for login banners and disabling user
> > lists have been replaced by Gnome 3's dconf parameters in RHEL 7 (and
> > Fedora, obviously). dconf allows users and admins to set certain
> > parameters with plain text key files. It also allows admins to bypass
> > key files and set parameters with a GVariant binary blob file. There are
> > some problems for us with both methods. I'll use the login banner text
> > settings as an example.
> >
> > The recommended method in the RHEL 7 administration guide is to create a
> > text file in /etc/dconf/db/gdm.d/ that looks something like the following:
> >
> > [org/gnome/login-screen]
> > banner-message-enable=true
> > banner-message-text='Consent banner text'
> >
> > After creating this file, the user must type dconf update, and the
> > settings are applied, making this a two step process. However, there is
> > a second way to apply the same settings, using the gsettings tool, which
> > will write the data as a binary data blob into the home directory of
> > whatever user runs the tool:
> >
> > sudo -u gdm dbus-launch gsettings set org.gnome.login-screen
> > banner-message-enable true
> >
> > This achieves the same effect and the consent banner will be displayed
> > to users in exactly the same way. This method is harder to test, since
> > there is no parseable text file for OVAL to evaluate, but it is
> > extremely easy to apply on the command line.
> >
> >
> > TLDR: Are we allowed to mandate that system administrators must use the
> > Red Hat guide's method of using plain text key files?
>
> Yes. That is the best way. I was involved with a bz a while back to work out
> the method and that is what they came up with:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=817594
I was told that this bz cannot be accessed. That bz is linked to gnome's
public bz which is found here:
https://bugzilla.gnome.org/show_bug.cgi?id=703972
It actually has better discussion than the one I was referencing.
-Steve
> I would be concerned if a setting in the local directory could be used to
> suppress the login banner. But doing the central configuration is the best
> thing to do.
>
> Also, in terms of meeting other NIST controls during login, be aware of this
> bz, too (comment 8 details the enhanced control that can be met):
>
> https://bugzilla.redhat.com/show_bug.cgi?id=915371
>
> -Steve
>
> > On a related note, the login banner text only displays AFTER users have
> > put in their user name, and there appears to be no way to edit the
> > consent banner's appearance without altering the GDM theme. Instead,
> > it's scrunched into a tiny window, with tiny grey text on a grey
> > background, with a scroll bar. Is it too late to put this on my RHEL 7
> > final release wish list or can someone point me to the correct settings?
> >
> > - Maura Dailey
> > _______________________________________________
> > scap-security-guide mailing list
> > scap-security-guide at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list