Skip to content

Commit bf1b010

Browse files
ggbeckerggbecker
committedNov 4, 2020
Break dconf_gnome_disable_automount down into three separate rules.
1 parent a3b768f commit bf1b010

File tree

19 files changed

+328
-115
lines changed

19 files changed

+328
-115
lines changed
 

‎linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/tests/empty.fail.sh

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
# profiles = xccdf_org.ssgproject.content_profile_ncp
3+
4+
source $SHARED/dconf_test_functions.sh
5+
6+
install_dconf_and_gdm_if_needed
7+
8+
clean_dconf_settings
9+

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/ansible/shared.yml

-31
Original file line numberDiff line numberDiff line change
@@ -17,34 +17,3 @@
1717
regexp: '^/org/gnome/desktop/media-handling/automount'
1818
line: '/org/gnome/desktop/media-handling/automount'
1919
create: yes
20-
21-
- name: "Disable GNOME3 Automounting - automount-open"
22-
ini_file:
23-
dest: /etc/dconf/db/local.d/00-security-settings
24-
section: org/gnome/desktop/media-handling
25-
option: automount-open
26-
value: "false"
27-
create: yes
28-
29-
- name: "Prevent user modification of GNOME3 Automounting - automount-open"
30-
lineinfile:
31-
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
32-
regexp: '^/org/gnome/desktop/media-handling/automount-open'
33-
line: '/org/gnome/desktop/media-handling/automount-open'
34-
create: yes
35-
36-
- name: "Disable GNOME3 Automounting - autorun-never"
37-
ini_file:
38-
dest: /etc/dconf/db/local.d/00-security-settings
39-
section: org/gnome/desktop/media-handling
40-
option: autorun-never
41-
value: "true"
42-
create: yes
43-
44-
- name: "Prevent user modification of GNOME3 Automounting - autorun-never"
45-
lineinfile:
46-
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
47-
regexp: '^/org/gnome/desktop/media-handling/autorun-never'
48-
line: '/org/gnome/desktop/media-handling/autorun-never'
49-
create: yes
50-

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/bash/shared.sh

-4
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,4 @@
22

33

44
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount", "false", "local.d", "00-security-settings") }}}
5-
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount-open", "false", "local.d", "00-security-settings") }}}
6-
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "autorun-never", "true", "local.d", "00-security-settings") }}}
75
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount", "local.d", "00-security-settings-lock") }}}
8-
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount-open", "local.d", "00-security-settings-lock") }}}
9-
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "autorun-never", "local.d", "00-security-settings-lock") }}}

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/oval/shared.xml

+2-58
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,15 @@
11
<def-group>
2-
<definition class="compliance" id="dconf_gnome_disable_automount" version="1">
2+
<definition class="compliance" id="dconf_gnome_disable_automount" version="2">
33
{{{ oval_metadata("The system's default desktop environment, GNOME3, will mount
44
devices and removable media (such as DVDs, CDs and USB flash drives)
55
whenever they are inserted into the system. Disable automount and autorun
66
within GNOME3.") }}}
77
<criteria operator="OR">
88
<extend_definition comment="dconf installed" definition_ref="package_dconf_installed" negate="true" />
9-
<criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
9+
<criteria comment="Disable GNOME3 automount and prevent user from changing it" operator="AND">
1010
<extend_definition comment="dconf user profile exists" definition_ref="enable_dconf_user_profile" />
1111
<criterion comment="Disable automount in GNOME3" test_ref="test_dconf_gnome_disable_automount" />
12-
<criterion comment="Disable automount-open in GNOME3" test_ref="test_dconf_gnome_disable_automount_open" />
13-
<criterion comment="Disable autorun in GNOME3" test_ref="test_dconf_gnome_disable_autorun" />
1412
<criterion comment="Prevent user from changing automount setting" test_ref="test_prevent_user_gnome_automount" />
15-
<criterion comment="Prevent user from changing automount-open setting" test_ref="test_prevent_user_gnome_automount_open" />
16-
<criterion comment="Prevent user from changing autorun setting" test_ref="test_prevent_user_gnome_autorun" />
1713
</criteria>
1814
</criteria>
1915
</definition>
@@ -43,56 +39,4 @@
4339
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
4440
<ind:instance datatype="int">1</ind:instance>
4541
</ind:textfilecontent54_object>
46-
47-
<ind:textfilecontent54_test check="all" check_existence="all_exist"
48-
comment="Disable automount-open in GNOME"
49-
id="test_dconf_gnome_disable_automount_open" version="1">
50-
<ind:object object_ref="obj_dconf_gnome_disable_automount_open" />
51-
</ind:textfilecontent54_test>
52-
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_automount_open"
53-
version="1">
54-
<ind:path>/etc/dconf/db/local.d/</ind:path>
55-
<ind:filename operation="pattern match">^.*$</ind:filename>
56-
<ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?automount-open=false$</ind:pattern>
57-
<ind:instance datatype="int">1</ind:instance>
58-
</ind:textfilecontent54_object>
59-
60-
<ind:textfilecontent54_test check="all" check_existence="all_exist"
61-
comment="Prevent user from changing automount-open setting"
62-
id="test_prevent_user_gnome_automount_open" version="1">
63-
<ind:object object_ref="obj_prevent_user_gnome_automount_open" />
64-
</ind:textfilecontent54_test>
65-
<ind:textfilecontent54_object id="obj_prevent_user_gnome_automount_open"
66-
version="1">
67-
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
68-
<ind:filename operation="pattern match">^.*$</ind:filename>
69-
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
70-
<ind:instance datatype="int">1</ind:instance>
71-
</ind:textfilecontent54_object>
72-
73-
<ind:textfilecontent54_test check="all" check_existence="all_exist"
74-
comment="Disable autorun in GNOME"
75-
id="test_dconf_gnome_disable_autorun" version="1">
76-
<ind:object object_ref="obj_dconf_gnome_disable_autorun" />
77-
</ind:textfilecontent54_test>
78-
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_autorun"
79-
version="1">
80-
<ind:path>/etc/dconf/db/local.d/</ind:path>
81-
<ind:filename operation="pattern match">^.*$</ind:filename>
82-
<ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
83-
<ind:instance datatype="int">1</ind:instance>
84-
</ind:textfilecontent54_object>
85-
86-
<ind:textfilecontent54_test check="all" check_existence="all_exist"
87-
comment="Prevent user from changing autorun setting"
88-
id="test_prevent_user_gnome_autorun" version="1">
89-
<ind:object object_ref="obj_prevent_user_gnome_autorun" />
90-
</ind:textfilecontent54_test>
91-
<ind:textfilecontent54_object id="obj_prevent_user_gnome_autorun"
92-
version="1">
93-
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
94-
<ind:filename operation="pattern match">^.*$</ind:filename>
95-
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
96-
<ind:instance datatype="int">1</ind:instance>
97-
</ind:textfilecontent54_object>
9842
</def-group>

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/rule.yml

+7-18
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,15 @@ title: 'Disable GNOME3 Automounting'
77
description: |-
88
The system's default desktop environment, GNOME3, will mount
99
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
10-
they are inserted into the system. To disable automount and autorun within GNOME3, add or set
11-
<tt>automount</tt> to <tt>false</tt>, <tt>automount-open</tt> to <tt>false</tt>, and
12-
<tt>autorun-never</tt> to <tt>true</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
10+
they are inserted into the system. To disable automount within GNOME3, add or set
11+
<tt>automount</tt> to <tt>false</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
1312
For example:
1413
<pre>[org/gnome/desktop/media-handling]
15-
automount=false
16-
automount-open=false
17-
autorun-never=true</pre>
14+
automount=false</pre>
1815
Once the settings have been added, add a lock to
1916
<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
2017
For example:
21-
<pre>/org/gnome/desktop/media-handling/automount
22-
/org/gnome/desktop/media-handling/automount-open
23-
/org/gnome/desktop/media-handling/autorun-never</pre>
18+
<pre>/org/gnome/desktop/media-handling/automount</pre>
2419
After the settings have been set, run <tt>dconf update</tt>.
2520
2621
rationale: |-
@@ -48,16 +43,10 @@ ocil_clause: 'GNOME automounting is not disabled'
4843

4944
ocil: |-
5045
These settings can be verified by running the following:
51-
<pre>$ gsettings get org.gnome.desktop.media-handling automount
52-
$ gsettings get org.gnome.desktop.media-handling automount-open
53-
$ gsettings get org.gnome.desktop.media-handling autorun-never</pre>
46+
<pre>$ gsettings get org.gnome.desktop.media-handling automount</pre>
5447
If properly configured, the output for <tt>automount</tt> should be <tt>false</tt>.
55-
If properly configured, the output for <tt>automount-open</tt>should be <tt>false</tt>.
56-
If properly configured, the output for <tt>autorun-never</tt> should be <tt>true</tt>.
57-
To ensure that users cannot enable automount and autorun in GNOME3, run the following:
58-
<pre>$ grep 'automount\|autorun' /etc/dconf/db/local.d/locks/*</pre>
48+
To ensure that users cannot enable automount in GNOME3, run the following:
49+
<pre>$ grep 'automount' /etc/dconf/db/local.d/locks/*</pre>
5950
If properly configured, the output for <tt>automount</tt> should be <tt>/org/gnome/desktop/media-handling/automount</tt>
60-
If properly configured, the output for <tt>automount-open</tt> should be <tt>/org/gnome/desktop/media-handling/auto-open</tt>
61-
If properly configured, the output for <tt>autorun-never</tt> should be <tt>/org/gnome/desktop/media-handling/autorun-never</tt>
6251
6352
platform: machine

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/tests/correct_value.pass.sh

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
# profiles = xccdf_org.ssgproject.content_profile_stig
3+
4+
. $SHARED/dconf_test_functions.sh
5+
6+
yum -y install dconf
7+
clean_dconf_settings
8+
9+
add_dconf_setting "org/gnome/desktop/media-handling" "automount" "false" "local.d" "00-security-settings"
10+
add_dconf_lock "org/gnome/desktop/media-handling" "automount" "local.d" "00-security-settings"
11+

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/ansible/shared.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# platform = multi_platform_rhel,multi_platform_fedora
2+
# reboot = false
3+
# strategy = unknown
4+
# complexity = low
5+
# disruption = medium
6+
- name: "Disable GNOME3 Automounting - automount-open"
7+
ini_file:
8+
dest: /etc/dconf/db/local.d/00-security-settings
9+
section: org/gnome/desktop/media-handling
10+
option: automount-open
11+
value: "false"
12+
create: yes
13+
14+
- name: "Prevent user modification of GNOME3 Automounting - automount-open"
15+
lineinfile:
16+
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
17+
regexp: '^/org/gnome/desktop/media-handling/automount-open'
18+
line: '/org/gnome/desktop/media-handling/automount-open'
19+
create: yes

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/bash/shared.sh

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora
2+
3+
4+
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount-open", "false", "local.d", "00-security-settings") }}}
5+
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount-open", "local.d", "00-security-settings-lock") }}}

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/oval/shared.xml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<def-group>
2+
<definition class="compliance" id="dconf_gnome_disable_automount_open" version="1">
3+
<metadata>
4+
<title>Disable GNOME3 automount-open</title>
5+
<affected family="unix">
6+
<platform>Red Hat Enterprise Linux 7</platform>
7+
<platform>Red Hat Enterprise Linux 8</platform>
8+
<platform>multi_platform_fedora</platform>
9+
</affected>
10+
<description>The system's default desktop environment, GNOME3, will mount
11+
devices and removable media (such as DVDs, CDs and USB flash drives)
12+
whenever they are inserted into the system. Disable automount-open
13+
within GNOME3.</description>
14+
</metadata>
15+
<criteria operator="OR">
16+
<extend_definition comment="dconf installed" definition_ref="package_dconf_installed" negate="true" />
17+
<criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
18+
<extend_definition comment="dconf user profile exists" definition_ref="enable_dconf_user_profile" />
19+
<criterion comment="Disable automount-open in GNOME3" test_ref="test_dconf_gnome_disable_automount_open" />
20+
<criterion comment="Prevent user from changing automount-open setting" test_ref="test_prevent_user_gnome_automount_open" />
21+
</criteria>
22+
</criteria>
23+
</definition>
24+
25+
<ind:textfilecontent54_test check="all" check_existence="all_exist"
26+
comment="Disable automount-open in GNOME"
27+
id="test_dconf_gnome_disable_automount_open" version="1">
28+
<ind:object object_ref="obj_dconf_gnome_disable_automount_open" />
29+
</ind:textfilecontent54_test>
30+
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_automount_open"
31+
version="1">
32+
<ind:path>/etc/dconf/db/local.d/</ind:path>
33+
<ind:filename operation="pattern match">^.*$</ind:filename>
34+
<ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?automount-open=false$</ind:pattern>
35+
<ind:instance datatype="int">1</ind:instance>
36+
</ind:textfilecontent54_object>
37+
38+
<ind:textfilecontent54_test check="all" check_existence="all_exist"
39+
comment="Prevent user from changing automount-open setting"
40+
id="test_prevent_user_gnome_automount_open" version="1">
41+
<ind:object object_ref="obj_prevent_user_gnome_automount_open" />
42+
</ind:textfilecontent54_test>
43+
<ind:textfilecontent54_object id="obj_prevent_user_gnome_automount_open"
44+
version="1">
45+
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
46+
<ind:filename operation="pattern match">^.*$</ind:filename>
47+
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
48+
<ind:instance datatype="int">1</ind:instance>
49+
</ind:textfilecontent54_object>
50+
</def-group>

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/rule.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
documentation_complete: true
2+
3+
prodtype: fedora,rhel7,rhel8
4+
5+
title: 'Disable GNOME3 Automount Opening'
6+
7+
description: |-
8+
The system's default desktop environment, GNOME3, will mount
9+
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
10+
they are inserted into the system. To disable automount-open within GNOME3, add or set
11+
<tt>automount-open</tt> to <tt>false</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
12+
For example:
13+
<pre>[org/gnome/desktop/media-handling]
14+
automount-open=false</pre>
15+
Once the settings have been added, add a lock to
16+
<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
17+
For example:
18+
<pre>/org/gnome/desktop/media-handling/automount-open</pre>
19+
After the settings have been set, run <tt>dconf update</tt>.
20+
21+
rationale: |-
22+
Disabling automatic mounting in GNOME3 can prevent
23+
the introduction of malware via removable media.
24+
It will, however, also prevent desktop users from legitimate use
25+
of removable media.
26+
27+
severity: medium
28+
29+
identifiers:
30+
cce@rhel7: CCE-83692-4
31+
cce@rhel8: CCE-83693-2
32+
33+
references:
34+
cui: 3.1.7
35+
nist: CM-7(a),CM-7(b),CM-6(a)
36+
nist-csf: PR.AC-3,PR.AC-6
37+
isa-62443-2013: 'SR 1.1,SR 1.13,SR 1.2,SR 1.4,SR 1.5,SR 1.9,SR 2.1,SR 2.6'
38+
isa-62443-2009: 4.3.3.2.2,4.3.3.5.2,4.3.3.6.6,4.3.3.7.2,4.3.3.7.4
39+
cobit5: APO13.01,DSS01.04,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS06.03
40+
iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.6.2.1,A.6.2.2,A.7.1.1,A.9.2.1
41+
cis-csc: 12,16
42+
stig@rhel7: RHEL-07-020111
43+
disa: CCI-001958
44+
srg: SRG-OS-000114-GPOS-00059,SRG-OS-000378-GPOS-00163,SRG-OS-000480-GPOS-00227
45+
46+
47+
ocil_clause: 'GNOME automounting is not disabled'
48+
49+
ocil: |-
50+
These settings can be verified by running the following:
51+
<pre>$ gsettings get org.gnome.desktop.media-handling automount-open</pre>
52+
If properly configured, the output for <tt>automount-open</tt>should be <tt>false</tt>.
53+
To ensure that users cannot enable automount opening in GNOME3, run the following:
54+
<pre>$ grep 'automount-open' /etc/dconf/db/local.d/locks/*</pre>
55+
If properly configured, the output for <tt>automount-open</tt> should be <tt>/org/gnome/desktop/media-handling/automount-open</tt>
56+
57+
platform: machine

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/correct_value.pass.sh

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
# profiles = xccdf_org.ssgproject.content_profile_stig
3+
4+
. $SHARED/dconf_test_functions.sh
5+
6+
yum -y install dconf
7+
clean_dconf_settings
8+
9+
add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "local.d" "00-security-settings"
10+
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "local.d" "00-security-settings"
11+
12+

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/wrong_value.fail.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
# profiles = xccdf_org.ssgproject.content_profile_stig
3+
4+
. $SHARED/dconf_test_functions.sh
5+
6+
yum -y install dconf
7+
clean_dconf_settings

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# platform = multi_platform_rhel,multi_platform_fedora
2+
# reboot = false
3+
# strategy = unknown
4+
# complexity = low
5+
# disruption = medium
6+
- name: "Disable GNOME3 Automounting - autorun-never"
7+
ini_file:
8+
dest: /etc/dconf/db/local.d/00-security-settings
9+
section: org/gnome/desktop/media-handling
10+
option: autorun-never
11+
value: "true"
12+
create: yes
13+
14+
- name: "Prevent user modification of GNOME3 Automounting - autorun-never"
15+
lineinfile:
16+
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
17+
regexp: '^/org/gnome/desktop/media-handling/autorun-never'
18+
line: '/org/gnome/desktop/media-handling/autorun-never'
19+
create: yes
20+

‎linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora
2+
3+
4+
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "autorun-never", "true", "local.d", "00-security-settings") }}}
5+
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "autorun-never", "local.d", "00-security-settings-lock") }}}

0 commit comments

Comments
 (0)
Please sign in to comment.