From eb3d5f4bd1f15419f105b7f543493c28ccf6b2bd Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 14 Apr 2021 16:37:51 +0200
Subject: [PATCH 1/4] update tests to test also for files in /etc/profile.d
 directory

---
 .../{comment.fail.sh => comment_profile.fail.sh}      |  2 ++
 .../accounts_tmout/tests/comment_profile_d.fail.sh    | 11 +++++++++++
 ...ct_value.pass.sh => correct_value_profile.pass.sh} |  2 ++
 .../tests/correct_value_profile_d.pass.sh             | 11 +++++++++++
 .../accounts_tmout/tests/line_not_there.fail.sh       |  1 +
 .../{multiline.fail.sh => multiline_profile.fail.sh}  |  2 ++
 .../accounts_tmout/tests/multiline_profile_d.fail.sh  | 11 +++++++++++
 .../accounts_tmout/tests/multiline_profile_d.pass.sh  |  9 +++++++++
 ...liance.pass.sh => supercompliance_profile.pass.sh} |  2 ++
 .../tests/supercompliance_profile_d.pass.sh           | 11 +++++++++++
 ...rong_value.fail.sh => wrong_value_profile.fail.sh} |  2 ++
 .../tests/wrong_value_profile_d.fail.sh               | 11 +++++++++++
 12 files changed, 75 insertions(+)
 rename linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/{comment.fail.sh => comment_profile.fail.sh} (80%)
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile_d.fail.sh
 rename linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/{correct_value.pass.sh => correct_value_profile.pass.sh} (80%)
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile_d.pass.sh
 rename linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/{multiline.fail.sh => multiline_profile.fail.sh} (84%)
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.pass.sh
 rename linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/{supercompliance.pass.sh => supercompliance_profile.pass.sh} (80%)
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile_d.pass.sh
 rename linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/{wrong_value.fail.sh => wrong_value_profile.fail.sh} (80%)
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile_d.fail.sh

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile.fail.sh
similarity index 80%
rename from linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment.fail.sh
rename to linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile.fail.sh
index ef123cd177e..91f258d5a9d 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile.fail.sh
@@ -2,6 +2,8 @@
 
 # variables = var_accounts_tmout=600
 
+sed -i "/.*TMOUT.*/d" /etc/profile.d/*.sh
+
 if grep -q "^TMOUT" /etc/profile; then
 	sed -i "s/^TMOUT.*/# TMOUT=600/" /etc/profile
 else
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile_d.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile_d.fail.sh
new file mode 100644
index 00000000000..0d7d5135586
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/comment_profile_d.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# variables = var_accounts_tmout=600
+
+sed -i "/.*TMOUT.*/d" /etc/profile
+
+if grep -q "^TMOUT" /etc/profile.d/tmout.sh; then
+	sed -i "s/^TMOUT.*/# TMOUT=600/" /etc/profile.d/tmout.sh
+else
+	echo "# TMOUT=600" >> /etc/profile.d/tmout.sh
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile.pass.sh
similarity index 80%
rename from linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value.pass.sh
rename to linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile.pass.sh
index 0d1b360dbdc..725ec381200 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile.pass.sh
@@ -2,6 +2,8 @@
 
 # variables = var_accounts_tmout=700
 
+sed -i "/.*TMOUT.*/d" /etc/profile.d/*.sh
+
 if grep -q "TMOUT" /etc/profile; then
 	sed -i "s/.*TMOUT.*/TMOUT=700/" /etc/profile
 else
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile_d.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile_d.pass.sh
new file mode 100644
index 00000000000..1cd8d26c357
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/correct_value_profile_d.pass.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# variables = var_accounts_tmout=700
+
+sed -i "/.*TMOUT.*/d" /etc/profile
+
+if grep -q "TMOUT" /etc/profile.d/tmout.sh; then
+	sed -i "s/.*TMOUT.*/TMOUT=700/" /etc/profile.d/tmout.sh
+else
+	echo "TMOUT=700" >> /etc/profile.d/tmout.sh
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/line_not_there.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/line_not_there.fail.sh
index af62eb12d51..4c36c1a842c 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/line_not_there.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/line_not_there.fail.sh
@@ -1,3 +1,4 @@
 #!/bin/bash
 
 sed -i "/^TMOUT.*/d" /etc/profile
+sed -i "/^TMOUT.*/d" /etc/profile.d/*.sh
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile.fail.sh
similarity index 84%
rename from linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline.fail.sh
rename to linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile.fail.sh
index 12aee2fe43a..fdf62efe723 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile.fail.sh
@@ -2,6 +2,8 @@
 
 # variables = var_accounts_tmout=700
 
+sed -i "/.*TMOUT.*/d" /etc/profile.d/*.sh
+
 if grep -q "TMOUT" /etc/profile; then
 	sed -i "s/.*TMOUT.*/TMOUT=900; readonly TMOUT; export TMOUT/" /etc/profile
 else
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.fail.sh
new file mode 100644
index 00000000000..25e77d33ae5
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# variables = var_accounts_tmout=900
+
+sed -i "/.*TMOUT.*/d" /etc/profile
+
+if grep -q "TMOUT" /etc/profile.d/tmout.sh; then
+	sed -i "s/.*TMOUT.*/TMOUT=950; readonly TMOUT; export TMOUT/" /etc/profile.d/tmout.sh
+else
+	echo "TMOUT=950; readonly TMOUT; export TMOUT" >> /etc/profile.d/tmout.sh
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.pass.sh
new file mode 100644
index 00000000000..5b3f169a469
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/multiline_profile_d.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# variables = var_accounts_tmout=700
+
+if grep -q "TMOUT" /etc/profile.d/tmout.sh; then
+	sed -i "s/.*TMOUT.*/TMOUT=700; readonly TMOUT; export TMOUT/" /etc/profile.d/tmout.sh
+else
+	echo "TMOUT=700; readonly TMOUT; export TMOUT" >> /etc/profile.d/tmout.sh
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile.pass.sh
similarity index 80%
rename from linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance.pass.sh
rename to linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile.pass.sh
index 50f97e14c91..9927bf7b5da 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile.pass.sh
@@ -2,6 +2,8 @@
 
 # variables = var_accounts_tmout=900
 
+sed -i "/.*TMOUT.*/d" /etc/profile.d/*.sh
+
 if grep -q "TMOUT" /etc/profile; then
 	sed -i "s/.*TMOUT.*/TMOUT=800/" /etc/profile
 else
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile_d.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile_d.pass.sh
new file mode 100644
index 00000000000..6316152a56b
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/supercompliance_profile_d.pass.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# variables = var_accounts_tmout=900
+
+sed -i "/.*TMOUT.*/d" /etc/profile
+
+if grep -q "TMOUT" /etc/profile.d/tmout.sh; then
+	sed -i "s/.*TMOUT.*/TMOUT=800/" /etc/profile.d/tmout.sh
+else
+	echo "TMOUT=800" >> /etc/profile.d/tmout.sh
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile.fail.sh
similarity index 80%
rename from linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value.fail.sh
rename to linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile.fail.sh
index a19002a4041..88b4ed6583f 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile.fail.sh
@@ -2,6 +2,8 @@
 
 # variables = var_accounts_tmout=200
 
+sed -i "/.*TMOUT.*/d" /etc/profile.d/*.sh
+
 if grep -q "^TMOUT" /etc/profile; then
 	sed -i "s/^TMOUT.*/TMOUT=250/" /etc/profile
 else
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile_d.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile_d.fail.sh
new file mode 100644
index 00000000000..1c98456e55e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/tests/wrong_value_profile_d.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# variables = var_accounts_tmout=900
+
+sed -i "/.*TMOUT.*/d" /etc/profile
+
+if grep -q "^TMOUT" /etc/profile.d/tmout.sh; then
+	sed -i "s/^TMOUT.*/TMOUT=950/" /etc/profile.d/tmout.sh
+else
+	echo "TMOUT=950" >> /etc/profile.d/tmout.sh
+fi

From 1bf99a57e35d6a41413bc6152313cb71e62c6e79 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 15 Apr 2021 15:38:46 +0200
Subject: [PATCH 2/4] update rule description

---
 .../system/accounts/accounts-session/accounts_tmout/rule.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
index 844ef8b1ddf..98306fc5266 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
@@ -7,7 +7,8 @@
 description: |-
     Setting the <tt>TMOUT</tt> option in <tt>/etc/profile</tt> ensures that
     all user sessions will terminate based on inactivity. The <tt>TMOUT</tt>
-    setting in <tt>/etc/profile</tt> should read as follows:
+    setting in a file loaded by <tt>/etc/profile</tt>, e.g.
+    <tt>/etc/profile.d/tmout.sh</tt> should read as follows:
     <pre>TMOUT={{{ xccdf_value("var_accounts_tmout") }}}</pre>
 
 rationale: |-
@@ -45,6 +46,6 @@
 ocil: |-
     Run the following command to ensure the <tt>TMOUT</tt> value is configured for all users
     on the system:
-    <pre>$ sudo grep TMOUT /etc/profile</pre>
+    <pre>$ sudo grep TMOUT /etc/profile /etc/profile.d/*.sh</pre>
     The output should return the following:
     <pre>TMOUT={{{ xccdf_value("var_accounts_tmout") }}}</pre>
 

From 37a7d0f665f5718b5979e955eaa47c83cff09f0e Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 15 Apr 2021 15:39:04 +0200
Subject: [PATCH 3/4] update bash remediation

---
 .../accounts_tmout/bash/shared.sh              | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh
index ba01c7eca30..490617332a8 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh
@@ -2,9 +2,17 @@
 . /usr/share/scap-security-guide/remediation_functions
 {{{ bash_instantiate_variables("var_accounts_tmout") }}}
 
-if grep --silent '^\s*TMOUT' /etc/profile ; then
-        sed -i -E "s/^(\s*)TMOUT\s*=\s*(\w|\$)*(.*)$/\1TMOUT=$var_accounts_tmout\3/g" /etc/profile
-else
-        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" >> /etc/profile
-        echo "TMOUT=$var_accounts_tmout" >> /etc/profile
+# if 0, no occurence of tmout found, if 1, occurence found
+tmout_found=0
+
+for f in /etc/profile /etc/profile.d/*.sh; do
+    if grep --silent '^\s*TMOUT' $f; then
+        sed -i -E "s/^(\s*)TMOUT\s*=\s*(\w|\$)*(.*)$/\1TMOUT=$var_accounts_tmout\3/g" $f
+        $tmout_found=1
+    fi
+done
+
+if [ $tmout_found -eq 0 ]; then
+        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" >> /etc/profile.d/tmout.sh
+        echo "TMOUT=$var_accounts_tmout" >> /etc/profile.d/tmout.sh
 fi

From 29ff79f15efda649581fa74296329bbd3f5b4d9d Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 15 Apr 2021 15:39:23 +0200
Subject: [PATCH 4/4] update ansible remediation

---
 .../accounts/accounts-session/accounts_tmout/ansible/shared.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml
index 2c3049006da..f37ac94873c 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml
@@ -5,4 +5,4 @@
 # disruption = low
 {{{ ansible_instantiate_variables("var_accounts_tmout") }}}
 
-{{{ ansible_etc_profile_set(parameter='TMOUT', value='{{ var_accounts_tmout }}') }}}
+{{{ ansible_set_config_file(file='/etc/profile.d/tmout.sh', parameter='TMOUT', separator='=', separator_regex='=', value='{{ var_accounts_tmout }}', create='yes') }}}