diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml index 5b3afb324df..67d6836e873 100644 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml @@ -14,12 +14,3 @@ - xorg-x11-server-Xwayland {{% endif %}} state: absent - - -- name: Switch to multi-user runlevel - file: - src: /usr/lib/systemd/system/multi-user.target - dest: /etc/systemd/system/default.target - state: link - force: yes - diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh index dbabe572d2a..496dc74be7c 100644 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/bash/shared.sh @@ -12,6 +12,3 @@ {{% if product not in ["rhel7", "ol7"] %}} {{{ bash_package_remove("xorg-x11-server-Xwayland") }}} {{% endif %}} - -# configure run level -systemctl set-default multi-user.target \ No newline at end of file diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml index 0710efe9f1b..0868ec6eae7 100644 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml @@ -2,10 +2,6 @@ {{{ oval_metadata("Ensure that the default runlevel target is set to multi-user.target.") }}} - {{%- if init_system == "systemd" and target_oval_version != [5, 10] %}} - - {{%- endif %}} sudo {{{ pkg_manager }}} remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland {{% endif %}} - Additionally, setting the system's default target to - multi-user.target will prevent automatic startup of the X server. - To do so, run: -
$ systemctl set-default multi-user.target
- You should see the following output: -
Removed symlink /etc/systemd/system/default.target.
-    Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.
- rationale: |- Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security @@ -72,6 +64,8 @@ warnings: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target which might bring your system to an inconsistent state requiring additional configuration to access the system - again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before + again. + The rule xwindows_runlevel_target can be used to configure the system to boot into the multi-user.target. + If a GUI is an operational requirement, a tailored profile that removes this rule should be used before continuing installation. {{{ ovirt_rule_notapplicable_warning("X11 graphic libraries are dependency of OpenStack Cinderlib storage provider") | indent(4) }}} diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh deleted file mode 100644 index 9bf62a42d28..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target.pass.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland - -systemctl set-default multi-user.target diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh deleted file mode 100644 index 4eeb6971486..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/correct_target_under_lib.pass.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland - -ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh new file mode 100644 index 00000000000..b3908cff002 --- /dev/null +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed.fail.sh @@ -0,0 +1,8 @@ +#!/bin/bash + +{{{ bash_package_install("xorg-x11-server-Xorg") }}} +{{{ bash_package_install("xorg-x11-server-utils") }}} +{{{ bash_package_install("xorg-x11-server-common") }}} +{{% if product not in ["rhel7", "ol7"] %}} +{{{ bash_package_install("xorg-x11-server-Xwayland") }}} +{{% endif %}} diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh new file mode 100644 index 00000000000..abafdbd624a --- /dev/null +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_installed_removed.pass.sh @@ -0,0 +1,16 @@ +#!/bin/bash +# based on shared/templates/package_removed/tests/package-installed-removed.pass.sh + +{{{ bash_package_install("xorg-x11-server-Xorg") }}} +{{{ bash_package_install("xorg-x11-server-utils") }}} +{{{ bash_package_install("xorg-x11-server-common") }}} +{{% if product not in ["rhel7", "ol7"] %}} +{{{ bash_package_install("xorg-x11-server-Xwayland") }}} +{{% endif %}} + +{{{ bash_package_remove("xorg-x11-server-Xorg") }}} +{{{ bash_package_remove("xorg-x11-server-utils") }}} +{{{ bash_package_remove("xorg-x11-server-common") }}} +{{% if product not in ["rhel7", "ol7"] %}} +{{{ bash_package_remove("xorg-x11-server-Xwayland") }}} +{{% endif %}} diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh new file mode 100644 index 00000000000..a403e108082 --- /dev/null +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/packages_removed.pass.sh @@ -0,0 +1,8 @@ +#!/bin/bash + +{{{ bash_package_remove("xorg-x11-server-Xorg") }}} +{{{ bash_package_remove("xorg-x11-server-utils") }}} +{{{ bash_package_remove("xorg-x11-server-common") }}} +{{% if product not in ["rhel7", "ol7"] %}} +{{{ bash_package_remove("xorg-x11-server-Xwayland") }}} +{{% endif %}} diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh deleted file mode 100644 index ff7d0efda29..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_correct_target.fail.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 7 -# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils - diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh deleted file mode 100644 index d8ecd8c7361..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel7_packages_installed_wrong_target.fail.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 7 -# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils - -systemctl set-default graphical.target diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh deleted file mode 100644 index 14f1a97bc4f..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8 -# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland - diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh deleted file mode 100644 index c678ef711d9..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash -# platform = Red Hat Enterprise Linux 8 -# packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland - -systemctl set-default graphical.target diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh deleted file mode 100644 index bf8a615b1dc..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target.fail.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland - -systemctl set-default graphical.target diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh deleted file mode 100644 index 652088b85ae..00000000000 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/wrong_target_under_lib.fail.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -yum -y remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland - -ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target