From 0286990e3776fa2d3ecbff101eba824bd2addfc7 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 20 Sep 2018 15:59:52 +0200 Subject: [PATCH 1/5] Add tests for dconf_gnome_screensaver_lock_enabled --- .../comment.fail.sh | 14 ++++++++++++++ .../correct_value.pass.sh | 19 +++++++++++++++++++ .../correct_value_unlocked.fail.sh | 13 +++++++++++++ .../line_not_there.fail.sh | 10 ++++++++++ .../wrong_value.fail.sh | 13 +++++++++++++ 5 files changed, 69 insertions(+) create mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh create mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh create mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh create mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh create mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh new file mode 100644 index 0000000000..e7598e6496 --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_ospp + +yum -y install dconf + +# It is ok if string is not found in any file +file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true + +if [ -n "$file" ] ; then + sed -i "s/^lock-enabled=.*/#lock-enabled=true/g" $file +else + echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings + echo "#lock-enabled=true" >> /etc/dconf/db/local.d/00-security-settings +fi diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh new file mode 100644 index 0000000000..0997842791 --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_ospp + +yum -y install dconf + +# It is ok if string is not found in any file +file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true +if [ -n "$file" ] ; then + sed -i "s/^lock-enabled=.*/lock-enabled=true/g" $file +else + echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings + echo "lock-enabled=true" >> /etc/dconf/db/local.d/00-security-settings +fi + +lockfile=$(grep -R "lock-enabled" /etc/dconf/db/local.d/locks) || true +if [ -z "$file" ] ; then + mkdir -p /etc/dconf/db/local.d/locks + echo "/org/gnome/desktop/screensaver/lock-enabled" >> /etc/dconf/db/local.d/locks/00-security-settings-lock +fi diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh new file mode 100644 index 0000000000..0fd465d43b --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_ospp + +yum -y install dconf + +# It is ok if string is not found in any file +file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true +if [ -n "$file" ] ; then + sed -i "s/^lock-enabled=.*/lock-enabled=true/g" $file +else + echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings + echo "lock-enabled=true" >> /etc/dconf/db/local.d/00-security-settings +fi diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh new file mode 100644 index 0000000000..fe09c8bf59 --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_ospp + +yum -y install dconf + +# It is ok if string is not found in any file +file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true +if [ -n "$file" ] ; then + sed -i "/^lock-enabled=.*/d" $file +fi diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh new file mode 100644 index 0000000000..eb9e91c595 --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_ospp + +yum -y install dconf + +# It is ok if string is not found in any file +file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true +if [ -n "$file" ] ; then + sed -i "s/^lock-enabled=.*/lock-enabled=false/g" $file +else + echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings + echo "lock-enabled=false" >> /etc/dconf/db/local.d/00-security-settings +fi From d935d096b769223b40cf8fb08be93b317e9f7076 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 20 Sep 2018 16:01:12 +0200 Subject: [PATCH 2/5] Do not accept commented keys as correct --- shared/bash_remediation_functions/include_dconf_settings.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/bash_remediation_functions/include_dconf_settings.sh b/shared/bash_remediation_functions/include_dconf_settings.sh index 9752698f34..ac79fe0653 100644 --- a/shared/bash_remediation_functions/include_dconf_settings.sh +++ b/shared/bash_remediation_functions/include_dconf_settings.sh @@ -32,7 +32,7 @@ function dconf_settings { echo "[${_path}]" >> ${DCONFFILE} echo "${_key}=${_value}" >> ${DCONFFILE} else - if grep -q "${_key}" ${SETTINGSFILES[@]} + if grep -q "^(?!#)${_key}" ${SETTINGSFILES[@]} then sed -i "s/${_key}\s*=\s*.*/${_key}=${_value}/g" ${SETTINGSFILES[@]} else From e8e8b1e8b55dfa67affa07eecf8054d5ca77108c Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 20 Sep 2018 16:10:24 +0200 Subject: [PATCH 3/5] Update dconf database after changing dconf setting --- shared/bash_remediation_functions/include_dconf_settings.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shared/bash_remediation_functions/include_dconf_settings.sh b/shared/bash_remediation_functions/include_dconf_settings.sh index ac79fe0653..02f9877e97 100644 --- a/shared/bash_remediation_functions/include_dconf_settings.sh +++ b/shared/bash_remediation_functions/include_dconf_settings.sh @@ -39,6 +39,8 @@ function dconf_settings { sed -i "\|\[${_path}]|a\\${_key}=${_value}" ${SETTINGSFILES[@]} fi fi + + dconf update } # Function to configure DConf locks for RHEL and Fedora systems. From 61bc573ca262c711c93304106c92ff423f186aa7 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 20 Sep 2018 21:18:46 +0200 Subject: [PATCH 4/5] Add common functions for testing Functions added: - Clean up all dconf settings - Add a dconf entry - Add a dconf lock --- .../group_gnome/dconf_test_functions.sh | 29 +++++++++++++++++++ .../comment.fail.sh | 15 ++++------ .../correct_value.pass.sh | 20 ++++--------- .../correct_value_unlocked.fail.sh | 13 +++------ .../line_not_there.fail.sh | 10 ------- .../setting_not_there.fail.sh | 7 +++++ .../wrong_value.fail.sh | 14 ++++----- 7 files changed, 55 insertions(+), 53 deletions(-) create mode 100644 tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh delete mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh create mode 100644 tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/setting_not_there.fail.sh diff --git a/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh b/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh new file mode 100644 index 0000000000..f76d68e523 --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh @@ -0,0 +1,29 @@ + +# Wipes out dconf db settings directory +clean_dconf_settings(){ + rm -rf /etc/dconf/db/* +} + +# Adds a new dconf setting +# $1 _path +# $2 _setting +# $3 _value +# $4 _db +# $5 _settingFile +add_dconf_setting() { + local _path=$1 _setting=$2 _value=$3 _db=$4 _settingFile=$5 + mkdir /etc/dconf/db/${_db} + echo "[${_path}]" > /etc/dconf/db/${_db}/${_settingFile} + echo "${_setting}=${_value}" >> /etc/dconf/db/${_db}/${_settingFile} +} + +# Adds a lock to a dconf setting +# $1 _path +# $2 _setting +# $3 _db +# $4 _settingFile +add_dconf_lock(){ + local _path=$1 _setting=$2 _db=$3 _settingFile=$4 + mkdir -p /etc/dconf/db/${_db}/locks + echo "/${_path}/${_setting}" >> /etc/dconf/db/${_db}/locks/${_settingFile} +} diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh index e7598e6496..b76dee4f33 100644 --- a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/comment.fail.sh @@ -1,14 +1,9 @@ #!/bin/bash # profiles = xccdf_org.ssgproject.content_profile_ospp -yum -y install dconf - -# It is ok if string is not found in any file -file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true +. ../../dconf_test_functions.sh -if [ -n "$file" ] ; then - sed -i "s/^lock-enabled=.*/#lock-enabled=true/g" $file -else - echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings - echo "#lock-enabled=true" >> /etc/dconf/db/local.d/00-security-settings -fi +yum -y install dconf +clean_dconf_settings +add_dconf_setting "org/gnome/desktop/screensaver" "#lock-enabled" "true" "local.d" "00-security-settings" +add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "local.d" "00-security-settings" diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh index 0997842791..a0e39c4409 100644 --- a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value.pass.sh @@ -1,19 +1,9 @@ #!/bin/bash # profiles = xccdf_org.ssgproject.content_profile_ospp -yum -y install dconf - -# It is ok if string is not found in any file -file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true -if [ -n "$file" ] ; then - sed -i "s/^lock-enabled=.*/lock-enabled=true/g" $file -else - echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings - echo "lock-enabled=true" >> /etc/dconf/db/local.d/00-security-settings -fi +. ../../dconf_test_functions.sh -lockfile=$(grep -R "lock-enabled" /etc/dconf/db/local.d/locks) || true -if [ -z "$file" ] ; then - mkdir -p /etc/dconf/db/local.d/locks - echo "/org/gnome/desktop/screensaver/lock-enabled" >> /etc/dconf/db/local.d/locks/00-security-settings-lock -fi +yum -y install dconf +clean_dconf_settings +add_dconf_setting "org/gnome/desktop/screensaver" "lock-enabled" "true" "local.d" "00-security-settings" +add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "local.d" "00-security-settings" diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh index 0fd465d43b..53dea6c471 100644 --- a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/correct_value_unlocked.fail.sh @@ -1,13 +1,8 @@ #!/bin/bash # profiles = xccdf_org.ssgproject.content_profile_ospp -yum -y install dconf +. ../../dconf_test_functions.sh -# It is ok if string is not found in any file -file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true -if [ -n "$file" ] ; then - sed -i "s/^lock-enabled=.*/lock-enabled=true/g" $file -else - echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings - echo "lock-enabled=true" >> /etc/dconf/db/local.d/00-security-settings -fi +yum -y install dconf +clean_dconf_settings +add_dconf_setting "org/gnome/desktop/screensaver" "lock-enabled" "true" "local.d" "00-security-settings" diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh deleted file mode 100644 index fe09c8bf59..0000000000 --- a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/line_not_there.fail.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# profiles = xccdf_org.ssgproject.content_profile_ospp - -yum -y install dconf - -# It is ok if string is not found in any file -file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true -if [ -n "$file" ] ; then - sed -i "/^lock-enabled=.*/d" $file -fi diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/setting_not_there.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/setting_not_there.fail.sh new file mode 100644 index 0000000000..38789f575d --- /dev/null +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/setting_not_there.fail.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_ospp + +. ../../dconf_test_functions.sh + +yum -y install dconf +clean_dconf_settings diff --git a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh index eb9e91c595..19536910b2 100644 --- a/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh +++ b/tests/data/group_system/group_software/group_gnome/group_gnome_screen_locking/rule_dconf_gnome_screensaver_lock_enabled/wrong_value.fail.sh @@ -1,13 +1,9 @@ #!/bin/bash # profiles = xccdf_org.ssgproject.content_profile_ospp -yum -y install dconf +. ../../dconf_test_functions.sh -# It is ok if string is not found in any file -file=$(grep -R "lock-enabled" /etc/dconf/db/local.d) || true -if [ -n "$file" ] ; then - sed -i "s/^lock-enabled=.*/lock-enabled=false/g" $file -else - echo "[org/gnome/desktop/screensaver]" > /etc/dconf/db/local.d/00-security-settings - echo "lock-enabled=false" >> /etc/dconf/db/local.d/00-security-settings -fi +yum -y install dconf +clean_dconf_settings +add_dconf_setting "org/gnome/desktop/screensaver" "lock-enabled" "false" "local.d" "00-security-settings" +add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "local.d" "00-security-settings" From cb2ca84970c783660c03464a55295243841baaa1 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 20 Sep 2018 21:34:58 +0200 Subject: [PATCH 5/5] Fix indents in dconf_test_functions.sh --- .../group_software/group_gnome/dconf_test_functions.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh b/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh index f76d68e523..07940ea272 100644 --- a/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh +++ b/tests/data/group_system/group_software/group_gnome/dconf_test_functions.sh @@ -1,7 +1,7 @@ # Wipes out dconf db settings directory clean_dconf_settings(){ - rm -rf /etc/dconf/db/* + rm -rf /etc/dconf/db/* } # Adds a new dconf setting @@ -12,7 +12,7 @@ clean_dconf_settings(){ # $5 _settingFile add_dconf_setting() { local _path=$1 _setting=$2 _value=$3 _db=$4 _settingFile=$5 - mkdir /etc/dconf/db/${_db} + mkdir /etc/dconf/db/${_db} echo "[${_path}]" > /etc/dconf/db/${_db}/${_settingFile} echo "${_setting}=${_value}" >> /etc/dconf/db/${_db}/${_settingFile} } @@ -24,6 +24,6 @@ add_dconf_setting() { # $4 _settingFile add_dconf_lock(){ local _path=$1 _setting=$2 _db=$3 _settingFile=$4 - mkdir -p /etc/dconf/db/${_db}/locks + mkdir -p /etc/dconf/db/${_db}/locks echo "/${_path}/${_setting}" >> /etc/dconf/db/${_db}/locks/${_settingFile} }