Skip to content

Commit 0f0466a

Browse files
dodysdodys
authored
Merge pull request #12951 from mpurg/ubuntu2404_cis_1.7.5
Extend dconf rules on Ubuntu to check if settings are locked
2 parents 63be4a8 + dce05b7 commit 0f0466a

18 files changed

+101
-0
lines changed

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/bash/shared.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
{{% if 'ubuntu' in product %}}
44
{{{ bash_enable_dconf_user_profile(profile="user", database="local") }}}
55
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
6+
{{{ bash_dconf_lock("org/gnome/desktop/screensaver", "idle-delay", "local.d", "00-security-settings-lock") }}}
67
{{% endif %}}
78

89
{{{ bash_instantiate_variables("inactivity_timeout_value") }}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/oval/shared.xml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
<extend_definition comment="dconf user profile exists" definition_ref="enable_dconf_user_profile" />
88
<criterion comment="idle delay has been configured" test_ref="test_screensaver_idle_delay" />
99
<criterion comment="idle delay is set correctly" test_ref="test_screensaver_idle_delay_setting" />
10+
{{% if 'ubuntu' in product %}}
11+
<criterion comment="screensaver idle delay setting is locked" test_ref="test_screensaver_idle_delay_locked" />
12+
{{% endif %}}
1013
</criteria>
1114
</criteria>
1215
</definition>
@@ -50,4 +53,19 @@
5053

5154
<external_variable comment="inactivity timeout variable" datatype="int"
5255
id="inactivity_timeout_value" version="1" />
56+
57+
{{% if 'ubuntu' in product %}}
58+
<ind:textfilecontent54_test check="all" check_existence="all_exist"
59+
comment="screensaver idle delay setting is locked"
60+
id="test_screensaver_idle_delay_locked" version="1">
61+
<ind:object object_ref="obj_screensaver_idle_delay_locked" />
62+
</ind:textfilecontent54_test>
63+
<ind:textfilecontent54_object id="obj_screensaver_idle_delay_locked"
64+
version="1">
65+
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
66+
<ind:filename operation="pattern match">^.*$</ind:filename>
67+
<ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-delay$</ind:pattern>
68+
<ind:instance datatype="int">1</ind:instance>
69+
</ind:textfilecontent54_object>
70+
{{% endif %}}
5371
</def-group>

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/comment.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,7 @@
66
clean_dconf_settings
77
add_dconf_profiles
88
add_dconf_setting "org/gnome/desktop/session" "#idle-delay" "uint32 900" "local.d" "00-security-settings"
9+
10+
{{% if 'ubuntu' in product %}}
11+
add_dconf_lock "org/gnome/desktop/screensaver" "idle-delay" "local.d" "00-security-settings"
12+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value.pass.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,7 @@ clean_dconf_settings
88

99
add_dconf_profiles
1010
add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d" "00-security-settings"
11+
12+
{{% if 'ubuntu' in product %}}
13+
add_dconf_lock "org/gnome/desktop/screensaver" "idle-delay" "local.d" "00-security-settings"
14+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_not_locked.fail.sh

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
# packages = dconf,gdm
4+
# variables = inactivity_timeout_value=900
5+
6+
. $SHARED/dconf_test_functions.sh
7+
8+
clean_dconf_settings
9+
10+
add_dconf_profiles
11+
add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d" "00-security-settings"

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_wrong_db.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,7 @@ clean_dconf_settings
88

99
add_dconf_profiles
1010
add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "dummy.d" "00-security-settings"
11+
12+
{{% if 'ubuntu' in product %}}
13+
add_dconf_lock "org/gnome/desktop/screensaver" "idle-delay" "local.d" "00-security-settings"
14+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/missing_profiles.fail.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@
88
clean_dconf_settings
99

1010
add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d" "00-security-settings"
11+
add_dconf_lock "org/gnome/desktop/screensaver" "idle-delay" "local.d" "00-security-settings"

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/setting_not_there.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,7 @@
55

66
clean_dconf_settings
77
add_dconf_profiles
8+
9+
{{% if 'ubuntu' in product %}}
10+
add_dconf_lock "org/gnome/desktop/screensaver" "idle-delay" "local.d" "00-security-settings"
11+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/wrong_value.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,7 @@
77
clean_dconf_settings
88
add_dconf_profiles
99
add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 2900" "local.d" "00-security-settings"
10+
11+
{{% if 'ubuntu' in product %}}
12+
add_dconf_lock "org/gnome/desktop/screensaver" "idle-delay" "local.d" "00-security-settings"
13+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/bash/shared.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
{{% if 'ubuntu' in product %}}
44
{{{ bash_enable_dconf_user_profile(profile="user", database="local") }}}
55
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
6+
{{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-delay", "local.d", "00-security-settings-lock") }}}
67
{{% endif %}}
78

89
{{{ bash_instantiate_variables("var_screensaver_lock_delay") }}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/oval/shared.xml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
<extend_definition comment="dconf user profile exists" definition_ref="enable_dconf_user_profile" />
99
<criterion comment="screensaver lock delay is configured" test_ref="test_screensaver_lock_delay" />
1010
<criterion comment="lock delay is set correctly" test_ref="test_screensaver_lock_delay_setting" />
11+
{{% if 'ubuntu' in product %}}
12+
<criterion comment="screensaver lock delay setting is locked" test_ref="test_screensaver_lock_delay_locked" />
13+
{{% endif %}}
1114
</criteria>
1215
</criteria>
1316
</definition>
@@ -51,4 +54,18 @@
5154

5255
<external_variable comment="screensaver lock delay variable" datatype="int"
5356
id="var_screensaver_lock_delay" version="1" />
57+
58+
{{% if 'ubuntu' in product %}}
59+
<ind:textfilecontent54_test check="all" check_existence="all_exist"
60+
comment="screensaver lock delay setting is locked"
61+
id="test_screensaver_lock_delay_locked" version="1">
62+
<ind:object object_ref="obj_screensaver_lock_delay_locked" />
63+
</ind:textfilecontent54_test>
64+
<ind:textfilecontent54_object id="obj_screensaver_lock_delay_locked" version="1">
65+
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
66+
<ind:filename operation="pattern match">^.*$</ind:filename>
67+
<ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
68+
<ind:instance datatype="int">1</ind:instance>
69+
</ind:textfilecontent54_object>
70+
{{% endif %}}
5471
</def-group>

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/comment.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,7 @@
66
clean_dconf_settings
77
add_dconf_profiles
88
add_dconf_setting "org/gnome/desktop/screensaver" "#lock-delay" "uint32 5" "local.d" "00-security-settings"
9+
10+
{{% if 'ubuntu' in product %}}
11+
add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings"
12+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value.pass.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,7 @@ clean_dconf_settings
88

99
add_dconf_profiles
1010
add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "local.d" "00-security-settings"
11+
12+
{{% if 'ubuntu' in product %}}
13+
add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings"
14+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_not_locked.fail.sh

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
# packages = dconf,gdm
4+
# variables = var_screensaver_lock_delay=5
5+
6+
. $SHARED/dconf_test_functions.sh
7+
8+
clean_dconf_settings
9+
10+
add_dconf_profiles
11+
add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "local.d" "00-security-settings"

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_wrong_db.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,7 @@
77
clean_dconf_settings
88
add_dconf_profiles
99
add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "dummy.d" "00-security-settings"
10+
11+
{{% if 'ubuntu' in product %}}
12+
add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings"
13+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/missing_profiles.fail.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@
88
clean_dconf_settings
99

1010
add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "local.d" "00-security-settings"
11+
add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings"

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/setting_not_there.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,7 @@
55

66
add_dconf_profiles
77
clean_dconf_settings
8+
9+
{{% if 'ubuntu' in product %}}
10+
add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings"
11+
{{% endif %}}

‎linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/wrong_value.fail.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,7 @@
77
clean_dconf_settings
88
add_dconf_profiles
99
add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 10" "local.d" "00-security-settings"
10+
11+
{{% if 'ubuntu' in product %}}
12+
add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings"
13+
{{% endif %}}

0 commit comments

Comments
 (0)