From ray.v.shaw.ctr at mail.mil Thu Aug 20 11:36:11 2015 Content-Type: multipart/mixed; boundary="===============1571205936277887672==" MIME-Version: 1.0 From: Shaw, Ray V CTR USARMY RDECOM ARL (US) To: scap-security-guide at lists.fedorahosted.org Subject: RE: [PATCH] Rewrote various GConf checks to standardize on xmlfilecontent tests and ensured they were actually checking the correct location (gconf.xml.mandatory, not gconf.xml.defaults). (UNCLASSIFIED) Date: Thu, 26 Dec 2013 19:07:07 +0000 Message-ID: <517F37858E593249B11B9B7B6BA732073121AC65@ucolhp9j.easf.csd.disa.mil> In-Reply-To: 52AF3331.3070200@eclipse.ncsc.mil --===============1571205936277887672== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Classification: UNCLASSIFIED Caveats: NONE [Sorry for the delayed response, especially since I'm pretty sure I opened = the BZ; I've been stupidly busy at work.] The checks still seem to be looking at gconf.xml.defaults for: gconf_gnome_screensaver_idle_activation_enabled.xml gconf_gnome_screensaver_idle_delay.xml gconf_gnome_screensaver_lock_enabled.xml gconf_gnome_screensaver_mode_blank.xml Did something go awry with part of this patch? I do see the commit in the = git log, and the "thumbnailers" check is looking at gconf.xml.mandatory. -- Ray Shaw (Contractor, STG) Army Research Laboratory CIO, Unix Support -----Original Message----- From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap-sec= urity-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Maura Dailey Sent: Monday, December 16, 2013 12:07 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: Re: [PATCH] Rewrote various GConf checks to standardize on xmlfile= content tests and ensured they were actually checking the correct location = (gconf.xml.mandatory, not gconf.xml.defaults). I pushed it! - Maura Dailey On 12/16/2013 11:59 AM, Shawn Wells wrote: > On 12/16/13, 11:43 AM, Maura Dailey wrote: >> I've been out sick, but I noticed that no one seems to have looked at = >> this one. Let me know if I can push this or if I need to change = >> something. >> >> Thanks, >> Maura Dailey >> >> On 11/25/2013 04:02 PM, Maura Dailey wrote: >>> Signed-off-by: Maura Dailey >>> --- >>> .../input/checks/gconf_gnome_disable_automount.xml | 59 = >>> +++++++++++--------- >>> .../checks/gconf_gnome_disable_thumbnailers.xml | 34 ++++++----- >>> ...f_gnome_screensaver_idle_activation_enabled.xml | 19 ++++-- >>> .../checks/gconf_gnome_screensaver_idle_delay.xml | 24 +++++--- >>> .../gconf_gnome_screensaver_lock_enabled.xml | 14 +++-- >>> .../checks/gconf_gnome_screensaver_mode_blank.xml | 12 +++- >>> RHEL6/input/checks/package_GConf2_installed.xml | 26 +++++++++ >>> .../input/checks/templates/packages_installed.csv | 1 + >>> RHEL6/input/fixes/bash/package_GConf2_installed.sh | 1 + >>> 9 files changed, 124 insertions(+), 66 deletions(-) >>> create mode 100644 RHEL6/input/checks/package_GConf2_installed.xml >>> create mode 100644 = >>> RHEL6/input/fixes/bash/package_GConf2_installed.sh >>> >>> diff --git a/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>> b/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>> index e2e7efc..f78fc89 100644 >>> --- a/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>> +++ b/RHEL6/input/checks/gconf_gnome_disable_automount.xml >>> @@ -1,41 +1,46 @@ >>> >>> - >> - id=3D"gconf_gnome_disable_automount" version=3D"1"> >>> + >> version=3D"1"> >>> >>> Disable GNOME Automounting >>> >>> Red Hat Enterprise Linux 6 >>> >>> - The system's default desktop environment, GNOME, = >>> will mount devices and removable media (such as DVDs, CDs and USB = >>> flash drives) whenever they are inserted into the system. Disable = >>> automount and autorun within GNOME. >>> + The system's default desktop environment, GNOME, >>> will mount >>> + devices and removable media (such as DVDs, CDs and USB flash >>> drives) >>> + whenever they are inserted into the system. Disable automount >>> and autorun >>> + within GNOME. >>> + >> ref_url=3D"test_attestation" /> >>> >>> - >>> + >>> + >> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>> >> test_ref=3D"test_gconf_gnome_disable_automount" /> >>> - >> test_ref=3D"test_gconf_gnome_disable_automount_autorun" /> >>> + >> test_ref=3D"test_gconf_gnome_disable_automount_autorun" /> >>> >>> >>> - >>> - >> - comment=3D"Disable automount in GNOME" >>> - id=3D"test_gconf_gnome_disable_automount" version=3D"1"> >>> + >> + comment=3D"Disable automount in GNOME" = >>> id=3D"test_gconf_gnome_disable_automount" >>> + version=3D"1"> >>> >>> - >>> - >> id=3D"obj_gconf_gnome_disable_automount" version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences >>> - %gconf.xml >>> - >> match">^\s*.entry\s+name=3D"media_automount"\s+mtime=3D"\d+"\s+type=3D"= bool"\s+value=3D"false"\/.$ >>> - 1 >>> - >>> - >>> - >> - comment=3D"Disable autorun in GNOME" >>> + = >>> + >> id=3D"state_gconf_gnome_disable_automount" version=3D"1"> >>> + false >>> + >>> + >> version=3D"1"> >>> + = >>> /etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc >>> es/%gconf.xml >>> + /gconf/entry[@name=3D'media_automount']/@value>> + > >>> + >>> + >> + comment=3D"Disable autorun in GNOME" >>> id=3D"test_gconf_gnome_disable_automount_autorun" version=3D"1"> >>> >> object_ref=3D"obj_gconf_gnome_disable_automount_autorun" /> >>> - >>> - >> id=3D"obj_gconf_gnome_disable_automount_autorun" version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences >>> - %gconf.xml >>> - >> match">^\s*.entry\s+name=3D"media_autorun_never"\s+mtime=3D"\d+"\s+type= =3D"bool"\s+value=3D"true"\/.$ >>> - 1 >>> - >>> - >>> + >> state_ref=3D"state_gconf_gnome_disable_automount_autorun" /> >>> + >>> + >> id=3D"state_gconf_gnome_disable_automount_autorun" version=3D"1"> >>> + true >>> + >>> + >> id=3D"obj_gconf_gnome_disable_automount_autorun" version=3D"1"> >>> + = >>> /etc/gconf/gconf.xml.mandatory/apps/nautilus/preferenc >>> es/%gconf.xml >>> + = >>> /gconf/entry[@name=3D'media_autorun_never']/@value>> th> >>> + >>> >>> diff --git a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>> b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>> index 72bf086..80045a3 100644 >>> --- a/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>> +++ b/RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml >>> @@ -1,28 +1,32 @@ >>> >>> - >> - id=3D"gconf_gnome_disable_thumbnailers" version=3D"1"> >>> + >> id=3D"gconf_gnome_disable_thumbnailers" version=3D"1"> >>> >>> Disable All GNOME Thumbnailers >>> >>> Red Hat Enterprise Linux 6 >>> >>> - The system's default desktop environment, GNOME, = >>> uses a number of different thumbnailer programs to generate = >>> thumbnails for any new or modified content in an opened folder. >>> Disable the execution of these thumbnail applications within = >>> GNOME. >>> + The system's default desktop environment, GNOME, >>> uses a >>> + number of different thumbnailer programs to generate >>> thumbnails for any >>> + new or modified content in an opened folder. Disable the >>> execution of >>> + these thumbnail applications within GNOME. >>> + >> ref_url=3D"test_attestation" /> >>> >>> - >>> + >>> + >> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>> >> test_ref=3D"test_gconf_gnome_disable_thumbnailers" /> >>> >>> >>> - >>> - >> - comment=3D"Disable thumbnailers in GNOME" >>> + >> + comment=3D"Disable thumbnailers in GNOME" >>> id=3D"test_gconf_gnome_disable_thumbnailers" version=3D"1"> >>> >> /> >>> - >>> - >> id=3D"obj_gconf_gnome_disable_thumbnailers" version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers >>> - %gconf.xml >>> - >> match">^\s*.entry\s+name=3D"disable_all"\s+mtime=3D"\d+"\s+type=3D"bool= "\s+value=3D"true"\/.$ >>> - 1 >>> - >>> - >>> + >> + /> >> id=3D"state_gconf_gnome_disable_thumbnailers" version=3D"1"> >>> + true >>> + >>> + >> id=3D"obj_gconf_gnome_disable_thumbnailers" version=3D"1"> >>> + = >>> /etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnail >>> ers/%gconf.xml >>> + /gconf/entry[@name=3D'disable_all']/@value >>> + >>> >>> diff --git >>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled >>> .xml = >>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled >>> .xml >>> >>> index 5776014..0d012a7 100644 >>> --- >>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled >>> .xml >>> >>> +++ = >>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_activation_enabled >>> .xml >>> >>> @@ -5,21 +5,26 @@ >>> >>> Red Hat Enterprise Linux 6 >>> >>> - Idle activation of the screen saver should be = >>> enabled. >>> + Idle activation of the screen saver should be >>> + enabled. >>> + >> ref_url=3D"test_attestation" /> >>> >>> - >>> + >>> + >> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>> >> test_ref=3D"test_gnome_screensaver_idle_activated" /> >>> >>> >>> - >> is activated on idle" id=3D"test_gnome_screensaver_idle_activated" >>> version=3D"1"> >>> + >> + comment=3D"gnome screensaver is activated on idle" >>> + id=3D"test_gnome_screensaver_idle_activated" version=3D"1"> >>> >> object_ref=3D"object_gnome_screensaver_idle_activated" /> >>> - >>> + >> + /> >>> >>> - >> version=3D"1"> >>> + >> id=3D"state_gnome_screensaver_idle_activated" version=3D"1"> >>> true >>> >>> >> id=3D"object_gnome_screensaver_idle_activated" version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.defaults/%gconf-tree.xml>> epath> >>> - >>> /gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir[@name= =3D' >>> gnome-screensaver']/entry[@name=3D'idle_activation_enabled']/local_sch >>> ema[1]/default[1]/@value >>> + = >>> /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ >>> %gconf.xml >>> + = >>> /gconf/entry[@name=3D'idle_activation_enabled']/@value >>> >>> >>> diff --git >>> a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>> b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>> index 70cc1c2..c77e608 100644 >>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_idle_delay.xml >>> @@ -5,22 +5,30 @@ >>> >>> Red Hat Enterprise Linux 6 >>> >>> - The allowed period of inactivity before the = >>> screensaver is activated. >>> + The allowed period of inactivity before the >>> screensaver is >>> + activated. >>> + >> ref_url=3D"test_attestation" /> >>> >>> - >>> + >>> + >> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>> >> test_ref=3D"test_gnome_screensaver_idle_delay" /> >>> >>> >>> - >> timeout period" id=3D"test_gnome_screensaver_idle_delay" version=3D"1"> >>> + >> + comment=3D"test screensaver timeout period" >>> + id=3D"test_gnome_screensaver_idle_delay" version=3D"1"> >>> >>> >>> >>> >> id=3D"object_gnome_screensaver_idle_delay" version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.defaults/%gconf-tree.xml >>> - >> operation=3D"equals">/gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/= dir >>> [@name=3D'gnome-screensaver']/entry[@name=3D'idle_delay']/local_schema[1 >>> ]/default[1]/@value >>> + = >>> /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ >>> %gconf.xml >>> + /gconf/entry[@name=3D'idle_delay']/@value >>> >>> - >> id=3D"state_gnome_screensaver_idle_delay" version=3D"1"> >>> - >> var_check=3D"all" var_ref=3D"inactivity_timeout_value" /> >>> + >> + id=3D"state_gnome_screensaver_idle_delay" version=3D"1"> >>> + >> var_check=3D"all" >>> + var_ref=3D"inactivity_timeout_value" /> >>> >>> - >> datatype=3D"int" id=3D"inactivity_timeout_value" version=3D"1" /> >>> + >> datatype=3D"int" >>> + id=3D"inactivity_timeout_value" version=3D"1" /> >>> >>> diff --git >>> a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>> b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>> index 06d3020..cc031fc 100644 >>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_lock_enabled.xml >>> @@ -5,19 +5,23 @@ >>> >>> Red Hat Enterprise Linux 6 >>> >>> - Idle activation of the screen lock should be = >>> enabled. >>> + Idle activation of the screen lock should be >>> + enabled. >>> + >> ref_url=3D"test_attestation" /> >>> >>> - >>> + >>> + >> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>> >> test_ref=3D"test_screensaver_lock_enabled" /> >>> >>> >>> - >> enabled" id=3D"test_screensaver_lock_enabled" version=3D"1"> >>> + >> enabled" >>> + id=3D"test_screensaver_lock_enabled" version=3D"1"> >>> >>> >>> >>> >> version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.defaults/%gconf-tree.xml>> epath> >>> - >>> /gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir[@name= =3D' >>> gnome-screensaver']/entry[@name=3D'lock_enabled']/local_schema[1]/defa >>> ult[1]/@value >>> + = >>> /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ >>> %gconf.xml >>> + /gconf/entry[@name=3D'lock_enabled']/@value >>> >>> >> version=3D"1"> >>> true >>> diff --git >>> a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>> b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>> index 7cad7cd..8229d71 100644 >>> --- a/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>> +++ b/RHEL6/input/checks/gconf_gnome_screensaver_mode_blank.xml >>> @@ -6,12 +6,16 @@ >>> Red Hat Enterprise Linux 6 >>> >>> The screen saver should be blank. >>> + >> ref_url=3D"test_attestation" /> >>> >>> - >>> + >>> + >> definition_ref=3D"package_GConf2_installed" negate=3D"true" /> >>> >> test_ref=3D"test_gnome_screensaver_mode" /> >>> >>> >>> - >> set to blank screen" id=3D"test_gnome_screensaver_mode" version=3D"1"> >>> + >> + comment=3D"gnome screensaver set to blank screen" >>> + id=3D"test_gnome_screensaver_mode" version=3D"1"> >>> >>> >>> >>> @@ -19,7 +23,7 @@ >>> blank-only >>> >>> >> version=3D"1"> >>> - >>> /etc/gconf/gconf.xml.defaults/%gconf-tree.xml>> epath> >>> - >>> /gconf/dir[@name=3D'schemas']/dir[@name=3D'apps']/dir[@name= =3D' >>> gnome-screensaver']/entry[@name=3D'mode']/local_schema[1]/default[1]/s >>> tringvalue[1]/text() >>> + = >>> /etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/ >>> %gconf.xml >>> + = >>> /gconf/entry[@name=3D'mode']/stringvalue[1]/text() >>> >>> >>> diff --git a/RHEL6/input/checks/package_GConf2_installed.xml >>> b/RHEL6/input/checks/package_GConf2_installed.xml >>> new file mode 100644 >>> index 0000000..032d76b >>> --- /dev/null >>> +++ b/RHEL6/input/checks/package_GConf2_installed.xml >>> @@ -0,0 +1,26 @@ >>> + >>> + >>> + >> + version=3D"1"> >>> + >>> + Package GConf2 Installed >>> + >>> + Red Hat Enterprise Linux 6 >>> + >>> + The RPM package GConf2 should be >>> installed. >>> + >> ref_url=3D"test_attestation"/> >>> + >>> + >>> + >> + test_ref=3D"test_package_GConf2_installed" /> >>> + >>> + >>> + >> + id=3D"test_package_GConf2_installed" version=3D"1" >>> + comment=3D"package GConf2 is installed"> >>> + >>> + >>> + >>> + GConf2 >>> + >>> + >>> diff --git a/RHEL6/input/checks/templates/packages_installed.csv >>> b/RHEL6/input/checks/templates/packages_installed.csv >>> index 990f332..d956daa 100644 >>> --- a/RHEL6/input/checks/templates/packages_installed.csv >>> +++ b/RHEL6/input/checks/templates/packages_installed.csv >>> @@ -1,6 +1,7 @@ >>> aide >>> audit >>> cronie >>> +GConf2 >>> iptables >>> iptables-ipv6 >>> irqbalance >>> diff --git a/RHEL6/input/fixes/bash/package_GConf2_installed.sh >>> b/RHEL6/input/fixes/bash/package_GConf2_installed.sh >>> new file mode 100644 >>> index 0000000..02c8768 >>> --- /dev/null >>> +++ b/RHEL6/input/fixes/bash/package_GConf2_installed.sh >>> @@ -0,0 +1 @@ >>> +yum -y install GConf2 > > This is great! Ack. > > This tracks back to > https://bugzilla.redhat.com/show_bug.cgi?id=3D1043053. Give a shout = > after you've pushed and I'll resolve the bug. > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide _______________________________________________ scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide Classification: UNCLASSIFIED Caveats: NONE --===============1571205936277887672==--