From dhaynes at mitre.org Thu Aug 20 11:36:00 2015 Content-Type: multipart/mixed; boundary="===============0354293428912558388==" MIME-Version: 1.0 From: Haynes, Dan To: scap-security-guide at lists.fedorahosted.org Subject: RE: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). Date: Mon, 16 Dec 2013 17:46:58 +0000 Message-ID: <6A1F6FD3001BDD40A94503E2223CEBD50AE0A0AF@IMCMBX03.MITRE.ORG> In-Reply-To: 52AF3331.3070200@eclipse.ncsc.mil --===============0354293428912558388== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable For the GConf checks, it looks like the content first used the ind-def:text= filecontent54_test and was just updated to use the ind-def:xmlfilecontent_t= est which seems like a good improvement to me. = Just curious, has anyone considered using the unix-def:gconf_test (http://o= val.mitre.org/language/version5.10.1/ovaldefinition/documentation/unix-defi= nitions-schema.html#gconf_test)? If so, are there any problems with the gc= onf_test that make using the ind-def:xmlfilecontent_test more desirable? T= his seems to be a good opportunity for me to get some feedback on the usabi= lity of the unix-def:gconf_test from an OVAL content authoring perspective = :). Thanks, Danny >-----Original Message----- = >From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap- >security-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Maura Dailey >Sent: Monday, December 16, 2013 12:07 PM >To: scap-security-guide(a)lists.fedorahosted.org >Subject: Re: [PATCH] Rewrote various GConf checks to standardize on >xmlfilecontent tests and ensured they were actually checking the correct >location (gconf.xml.mandatory, not gconf.xml.defaults). > >I pushed it! > >- Maura Dailey > >On 12/16/2013 11:59 AM, Shawn Wells wrote: >> On 12/16/13, 11:43 AM, Maura Dailey wrote: >>> I've been out sick, but I noticed that no one seems to have looked at >>> this one. Let me know if I can push this or if I need to change >>> something. >>> >>> Thanks, >>> Maura Dailey >>> >>> On 11/25/2013 04:02 PM, Maura Dailey wrote: >>>> Signed-off-by: Maura Dailey >>>> --- >>>> .../input/checks/gconf_gnome_disable_automount.xml | 59 >>>> +++++++++++--------- >>>> .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- >>>> ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- >>>> .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- >>>> .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- >>>> .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- >>>> RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ >>>> .../input/checks/templates/packages_installed.csv | 1 + >>>> RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + >>>> 9 files changed, 124 insertions(+), 66 deletions(-) >>>> create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml >>>> create mode 100644 >RHEL6/input/fixes/bash/package_GConf2_installed.sh >>>> >>>> diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>>> b/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>>> index e2e7efc..f78fc89 100644 >>>> --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>>> +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>>> @@ -1,41 +1,46 @@ >>>> >>>> - >>> - id=3D"gconf_gnome_disable_automount" version=3D"1"> >>>> + >>> version=3D"1"> >>>> >>>> Disable GNOME Automounting >>>> >>>> Red Hat Enterprise Linux 6 >>>> >>>> - The system's default desktop environment, GNOME, >>>> will mount devices and removable media (such as DVDs, CDs and USB >>>> flash drives) whenever they are inserted into the system. Disable >>>> automount and autorun within GNOME. >>>> + The system's default desktop environment, GNOME, >>>> will mount >>>> + devices and removable media (such as DVDs, CDs and USB flash >>>> drives) >>>> + whenever they are inserted into the system. Disable automount >>>> and autorun >>>> + within GNOME. >>>> + >>> ref_url=3D"test_attestation" /> >>>> >>>> - >>>> + >>>> + >>> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>>> >>> test_ref=3D"test_gconf_gnome_disable_automount" /> >>>> - >>> test_ref=3D"test_gconf_gnome_disable_automount_autorun" /> >>>> + >>> test_ref=3D"test_gconf_gnome_disable_automount_autorun" /> >>>> >>>> >>>> - >>>> - >>> - comment=3D"Disable automount in GNOME" >>>> - id=3D"test_gconf_gnome_disable_automount" version=3D"1"> >>>> + >>> + comment=3D"Disable automount in GNOME" >>>> id=3D"test_gconf_gnome_disable_automount" >>>> + version=3D"1"> >>>> >>>> - >>>> - >>> id=3D"obj_gconf_gnome_disable_automount" version=3D"1"> >>>> - >>>> >/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferencesath> >>>> - %gconf.xml >>>> - >>> >match">^\s*.entry\s+name=3D"media_automount"\s+mtime=3D"\d+"\s+type=3D"bo >ol"\s+value=3D"false"\/.$ >>>> - 1 >>>> - >>>> - >>>> - >>> - comment=3D"Disable autorun in GNOME" >>>> + >>>> + >>>> + >>> id=3D"state_gconf_gnome_disable_automount" version=3D"1"> >>>> + false >>>> + >>>> + >>> version=3D"1"> >>>> + >>>> >/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%g >conf.xml >>>> + >/gconf/entry[@name=3D'media_automount']/@value >>>> + >>>> + >>> + comment=3D"Disable autorun in GNOME" >>>> id=3D"test_gconf_gnome_disable_automount_autorun" version=3D"1"> >>>> >>> object_ref=3D"obj_gconf_gnome_disable_automount_autorun" /> >>>> - >>>> - >>> id=3D"obj_gconf_gnome_disable_automount_autorun" version=3D"1"> >>>> - >>>> >/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferencesath> >>>> - %gconf.xml >>>> - >>> >match">^\s*.entry\s+name=3D"media_autorun_never"\s+mtime=3D"\d+"\s+type=3D >"bool"\s+value=3D"true"\/.$ >>>> - 1 >>>> - >>>> - >>>> + >>> state_ref=3D"state_gconf_gnome_disable_automount_autorun" /> >>>> + >>>> + >>> id=3D"state_gconf_gnome_disable_automount_autorun" version=3D"1"> >>>> + true >>>> + >>>> + >>> id=3D"obj_gconf_gnome_disable_automount_autorun" version=3D"1"> >>>> + >>>> >/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%g >conf.xml >>>> + >>>> >/gconf/entry[@name=3D'media_autorun_never']/@valueh> >>>> + >>>> >>>> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>>> b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>>> index 72bf086..80045a3 100644 >>>> --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>>> +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>>> @@ -1,28 +1,32 @@ >>>> >>>> - >>> - id=3D"gconf_gnome_disable_thumbnailers" version=3D"1"> >>>> + >>> id=3D"gconf_gnome_disable_thumbnailers" version=3D"1"> >>>> >>>> Disable All GNOME Thumbnailers >>>> >>>> Red Hat Enterprise Linux 6 >>>> >>>> - The system's default desktop environment, GNOME, >>>> uses a number of different thumbnailer programs to generate >>>> thumbnails for any new or modified content in an opened folder. >>>> Disable the execution of these thumbnail applications within >>>> GNOME. >>>> + The system's default desktop environment, GNOME, >>>> uses a >>>> + number of different thumbnailer programs to generate >>>> thumbnails for any >>>> + new or modified content in an opened folder. Disable the >>>> execution of >>>> + these thumbnail applications within GNOME. >>>> + >>> ref_url=3D"test_attestation" /> >>>> >>>> - >>>> + >>>> + >>> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>>> >>> test_ref=3D"test_gconf_gnome_disable_thumbnailers" /> >>>> >>>> >>>> - >>>> - >>> - comment=3D"Disable thumbnailers in GNOME" >>>> + >>> + comment=3D"Disable thumbnailers in GNOME" >>>> id=3D"test_gconf_gnome_disable_thumbnailers" version=3D"1"> >>>> >>>> - >>>> - >>> id=3D"obj_gconf_gnome_disable_thumbnailers" version=3D"1"> >>>> - >>>> >/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailersnd:path> >>>> - %gconf.xml >>>> - >>> >match">^\s*.entry\s+name=3D"disable_all"\s+mtime=3D"\d+"\s+type=3D"bool"\s= +va >lue=3D"true"\/.$ >>>> - 1 >>>> - >>>> - >>>> + >>>> + >>>> + >>> id=3D"state_gconf_gnome_disable_thumbnailers" version=3D"1"> >>>> + true >>>> + >>>> + >>> id=3D"obj_gconf_gnome_disable_thumbnailers" version=3D"1"> >>>> + >>>> >/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers >/%gconf.xml >>>> + /gconf/entry[@name=3D'disable_all']/@value >>>> + >>>> >>>> diff --git >>>> >a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xm >l >>>> >b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.x >ml >>>> >>>> index 5776014..0d012a7 100644 >>>> --- >>>> >a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.xm >l >>>> >>>> +++ >>>> >b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled.x >ml >>>> >>>> @@ -5,21 +5,26 @@ >>>> >>>> Red Hat Enterprise Linux 6 >>>> >>>> - Idle activation of the screen saver should be >>>> enabled. >>>> + Idle activation of the screen saver should be >>>> + enabled. >>>> + >>> ref_url=3D"test_attestation" /> >>>> >>>> - >>>> + >>>> + >>> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>>> >>> test_ref=3D"test_gnome_screensaver_idle_activated" /> >>>> >>>> >>>> - >>> is activated on idle" id=3D"test_gnome_screensaver_idle_activated" >>>> version=3D"1"> >>>> + >>> + comment=3D"gnome screensaver is activated on idle" >>>> + id=3D"test_gnome_screensaver_idle_activated" version=3D"1"> >>>> >>> object_ref=3D"object_gnome_screensaver_idle_activated" /> >>>> - >>>> + >>>> >>>> - >>>> + >>> id=3D"state_gnome_screensaver_idle_activated" version=3D"1"> >>>> true >>>> >>>> >>> id=3D"object_gnome_screensaver_idle_activated" version=3D"1"> >>>> - >>>> /etc/gconf/gconf.xml.defaults/%gconf- >tree.xml >>>> - >>>> >/gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir[@name=3D'= gn >ome- >screensaver']/entry[@name=3D'idle_activation_enabled']/local_schema[1]/def= au >lt[1]/@value >>>> + >>>> /etc/gconf/gconf.xml.mandatory/apps/gnome- >screensaver/%gconf.xml >>>> + >>>> >/gconf/entry[@name=3D'idle_activation_enabled']/@valueth> >>>> >>>> >>>> diff --git >>>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>>> index 70cc1c2..c77e608 100644 >>>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>>> @@ -5,22 +5,30 @@ >>>> >>>> Red Hat Enterprise Linux 6 >>>> >>>> - The allowed period of inactivity before the >>>> screensaver is activated. >>>> + The allowed period of inactivity before the >>>> screensaver is >>>> + activated. >>>> + >>> ref_url=3D"test_attestation" /> >>>> >>>> - >>>> + >>>> + >>> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>>> >>> test_ref=3D"test_gnome_screensaver_idle_delay" /> >>>> >>>> >>>> - >>> timeout period" id=3D"test_gnome_screensaver_idle_delay" version=3D"1"> >>>> + >>> + comment=3D"test screensaver timeout period" >>>> + id=3D"test_gnome_screensaver_idle_delay" version=3D"1"> >>>> >>>> >>>> >>>> >>> id=3D"object_gnome_screensaver_idle_delay" version=3D"1"> >>>> - >>>> /etc/gconf/gconf.xml.defaults/%gconf- >tree.xml >>>> - >>> >operation=3D"equals">/gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir= [@ >name=3D'gnome- >screensaver']/entry[@name=3D'idle_delay']/local_schema[1]/default[1]/@valu= e< >/ind:xpath> >>>> + >>>> /etc/gconf/gconf.xml.mandatory/apps/gnome- >screensaver/%gconf.xml >>>> + /gconf/entry[@name=3D'idle_delay']/@value >>>> >>>> - >>> id=3D"state_gnome_screensaver_idle_delay" version=3D"1"> >>>> - >>> var_check=3D"all" var_ref=3D"inactivity_timeout_value" /> >>>> + >>> + id=3D"state_gnome_screensaver_idle_delay" version=3D"1"> >>>> + >>> var_check=3D"all" >>>> + var_ref=3D"inactivity_timeout_value" /> >>>> >>>> - >>> datatype=3D"int" id=3D"inactivity_timeout_value" version=3D"1" /> >>>> + >>> datatype=3D"int" >>>> + id=3D"inactivity_timeout_value" version=3D"1" /> >>>> >>>> diff --git >>>> a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>>> b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>>> index 06d3020..cc031fc 100644 >>>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>>> @@ -5,19 +5,23 @@ >>>> >>>> Red Hat Enterprise Linux 6 >>>> >>>> - Idle activation of the screen lock should be >>>> enabled. >>>> + Idle activation of the screen lock should be >>>> + enabled. >>>> + >>> ref_url=3D"test_attestation" /> >>>> >>>> - >>>> + >>>> + >>> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>>> >>> test_ref=3D"test_screensaver_lock_enabled" /> >>>> >>>> >>>> - >>> enabled" id=3D"test_screensaver_lock_enabled" version=3D"1"> >>>> + >>> enabled" >>>> + id=3D"test_screensaver_lock_enabled" version=3D"1"> >>>> >>>> >>>> >>>> >>> version=3D"1"> >>>> - >>>> /etc/gconf/gconf.xml.defaults/%gconf- >tree.xml >>>> - >>>> >/gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir[@name=3D'= gn >ome- >screensaver']/entry[@name=3D'lock_enabled']/local_schema[1]/default[1]/@val >ue >>>> + >>>> /etc/gconf/gconf.xml.mandatory/apps/gnome- >screensaver/%gconf.xml >>>> + /gconf/entry[@name=3D'lock_enabled']/@value >>>> >>>> >>> version=3D"1"> >>>> true >>>> diff --git >>>> a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>>> b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>>> index 7cad7cd..8229d71 100644 >>>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>>> @@ -6,12 +6,16 @@ >>>> Red Hat Enterprise Linux 6 >>>> >>>> The screen saver should be blank. >>>> + >>> ref_url=3D"test_attestation" /> >>>> >>>> - >>>> + >>>> + >>> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>>> >>> test_ref=3D"test_gnome_screensaver_mode" /> >>>> >>>> >>>> - >>> set to blank screen" id=3D"test_gnome_screensaver_mode" version=3D"1"> >>>> + >>> + comment=3D"gnome screensaver set to blank screen" >>>> + id=3D"test_gnome_screensaver_mode" version=3D"1"> >>>> >>>> >>>> >>>> @@ -19,7 +23,7 @@ >>>> blank-only >>>> >>>> >>> version=3D"1"> >>>> - >>>> /etc/gconf/gconf.xml.defaults/%gconf- >tree.xml >>>> - >>>> >/gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir[@name=3D'= gn >ome- >screensaver']/entry[@name=3D'mode']/local_schema[1]/default[1]/stringvalue= [1 >]/text() >>>> + >>>> /etc/gconf/gconf.xml.mandatory/apps/gnome- >screensaver/%gconf.xml >>>> + >>>> >/gconf/entry[@name=3D'mode']/stringvalue[1]/text() >>>> >>>> >>>> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml >>>> b/RHEL6/input/checks/package_GConf2_installed.xml >>>> new file mode 100644 >>>> index 0000000..032d76b >>>> --- /dev/null >>>> +++ b/RHEL6/input/checks/package_GConf2_installed.xml >>>> @@ -0,0 +1,26 @@ >>>> + >>>> + >>>> + >>> + version=3D"1"> >>>> + >>>> + Package GConf2 Installed >>>> + >>>> + Red Hat Enterprise Linux 6 >>>> + >>>> + The RPM package GConf2 should be >>>> installed. >>>> + >>> ref_url=3D"test_attestation"/> >>>> + >>>> + >>>> + >>> + test_ref=3D"test_package_GConf2_installed" /> >>>> + >>>> + >>>> + >>> + id=3D"test_package_GConf2_installed" version=3D"1" >>>> + comment=3D"package GConf2 is installed"> >>>> + >>>> + >>>> + version=3D"1"> >>>> + GConf2 >>>> + >>>> + >>>> diff --git a/RHEL6/input/checks/templates/packages_installed.csv >>>> b/RHEL6/input/checks/templates/packages_installed.csv >>>> index 990f332..d956daa 100644 >>>> --- a/RHEL6/input/checks/templates/packages_installed.csv >>>> +++ b/RHEL6/input/checks/templates/packages_installed.csv >>>> @@ -1,6 +1,7 @@ >>>> aide >>>> audit >>>> cronie >>>> +GConf2 >>>> iptables >>>> iptables-ipv6 >>>> irqbalance >>>> diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh >>>> b/RHEL6/input/fixes/bash/package_GConf2_installed.sh >>>> new file mode 100644 >>>> index 0000000..02c8768 >>>> --- /dev/null >>>> +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh >>>> @@ -0,0 +1 @@ >>>> +yum -y install GConf2 >> >> This is great! Ack. >> >> This tracks back to >> https://bugzilla.redhat.com/show_bug.cgi?id=3D1043053. Give a shout >> after you've pushed and I'll resolve the bug. >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > >_______________________________________________ >scap-security-guide mailing list >scap-security-guide(a)lists.fedorahosted.org >https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide --===============0354293428912558388==--