Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,4 @@
# complexity = low
# disruption = medium

- name: "Configure GNOME3 DConf User Profile"
ansible.builtin.lineinfile:
dest: "/etc/dconf/profile/gdm"
line: "user-db:user\nsystem-db:gdm"
create: yes
state: present
{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# platform = multi_platform_sle

echo -e 'user-db:user\nsystem-db:gdm' > /etc/dconf/profile/gdm
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,10 @@
create: yes
register: result_lineinfile

{{% if product in ['sle15', 'sle16'] %}}
{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

- name: Dconf Update
ansible.builtin.command: dconf update
when: result_ini is changed or result_lineinfile is changed
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,9 @@
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

{{% if product in ['sle15', 'sle16'] %}}
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

{{{ bash_dconf_settings("org/gnome/login-screen", "disable-user-list", "true", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/login-screen", "disable-user-list", dconf_gdm_dir, "00-security-settings-lock") }}}
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,13 @@ fixtext: |-
Configure {{{ full_name }}} to disable the user list at logon for graphical user interfaces.

Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command:
Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory.
Note: The example below is using the database "{{{ dconf_gdm_dir }}}" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory.

$ sudo touch /etc/dconf/db/local.d/02-login-screen
$ sudo touch /etc/dconf/db/{{{ dconf_gdm_dir }}}/02-login-screen

[org/gnome/login-screen]
disable-user-list=true

Update the system databases:

$ sudo dconf update

Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
# platform = multi_platform_sle,multi_platform_slmicro

if ! (sed -n '/^DISPLAYMANAGER_AUTOLOGIN=\"\"/p' /etc/sysconfig/displaymanager)
then
if ! grep -q '^DISPLAYMANAGER_AUTOLOGIN=""' /etc/sysconfig/displaymanager; then
sed -i "s/^DISPLAYMANAGER_AUTOLOGIN=.*/DISPLAYMANAGER_AUTOLOGIN=\"\"/g" /etc/sysconfig/displaymanager
fi

if ! (sed -n '/^DISPLAYMANAGER_PASSWORD_LESS_LOGIN=\"no\"/p' /etc/sysconfig/displaymanager)
then
if ! grep -q '^DISPLAYMANAGER_PASSWORD_LESS_LOGIN="no"' /etc/sysconfig/displaymanager; then
sed -i "s/^DISPLAYMANAGER_PASSWORD_LESS_LOGIN=.*/DISPLAYMANAGER_PASSWORD_LESS_LOGIN=\"no\"/g" /etc/sysconfig/displaymanager
fi
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
# disruption = medium
- name: "Disable GNOME3 Automounting - automount"
community.general.ini_file:
dest: /etc/dconf/db/local.d/00-security-settings
dest: /etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings
section: org/gnome/desktop/media-handling
option: automount
value: "false"
Expand All @@ -15,20 +15,14 @@

- name: "Prevent user modification of GNOME3 Automounting - automount"
ansible.builtin.lineinfile:
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings
regexp: '^/org/gnome/desktop/media-handling/automount$'
line: '/org/gnome/desktop/media-handling/automount'
create: yes
register: result_lineinfile

# apply fix for enable_dconf_user_profile, OVAL checks it
{{% if product in ['sle15', 'sle16'] %}}
- name: "Configure GNOME3 DConf User Profile"
ansible.builtin.lineinfile:
dest: "/etc/dconf/profile/gdm"
line: "user-db:user\nsystem-db:gdm"
create: yes
state: present
{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

- name: Dconf Update
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,5 @@
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount", "false", "local.d", "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount", "local.d", "00-security-settings-lock") }}}
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount", "false", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount", dconf_gdm_dir, "00-security-settings-lock") }}}
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_automount"
version="1">
<ind:path>/etc/dconf/db/local.d/</ind:path>
<ind:path>/etc/dconf/db/{{{ dconf_gdm_dir }}}/</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount=false$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
Expand All @@ -33,7 +33,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_prevent_user_gnome_automount"
version="1">
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
<ind:path>/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ description: |-
The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount within GNOME3, add or set
<tt>automount</tt> to <tt>false</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
<tt>automount</tt> to <tt>false</tt> in <tt>/etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings</tt>.
For example:
<pre>[org/gnome/desktop/media-handling]
automount=false</pre>
Once the settings have been added, add a lock to
<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
<tt>/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock</tt> to prevent user modification.
For example:
<pre>/org/gnome/desktop/media-handling/automount</pre>
After the settings have been set, run <tt>dconf update</tt>.
Expand Down Expand Up @@ -51,6 +51,5 @@ ocil: |-
<pre>$ gsettings get org.gnome.desktop.media-handling automount</pre>
If properly configured, the output for <tt>automount</tt> should be <tt>false</tt>.
To ensure that users cannot enable automount in GNOME3, run the following:
<pre>$ grep 'automount' /etc/dconf/db/local.d/locks/*</pre>
<pre>$ grep 'automount' /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/*</pre>
If properly configured, the output for <tt>automount</tt> should be <tt>/org/gnome/desktop/media-handling/automount</tt>

Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,5 @@ install_dconf_and_gdm_if_needed
clean_dconf_settings

add_dconf_profiles
add_dconf_setting "org/gnome/desktop/media-handling" "automount" "false" "local.d" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount" "local.d" "00-security-settings"

add_dconf_setting "org/gnome/desktop/media-handling" "automount" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount" "{{{ dconf_gdm_dir }}}" "00-security-settings"
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,5 @@
install_dconf_and_gdm_if_needed
clean_dconf_settings

add_dconf_setting "org/gnome/desktop/media-handling" "automount" "false" "local.d" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount" "local.d" "00-security-settings"
add_dconf_setting "org/gnome/desktop/media-handling" "automount" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount" "{{{ dconf_gdm_dir }}}" "00-security-settings"
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ install_dconf_and_gdm_if_needed
clean_dconf_settings

add_dconf_profiles
add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "local.d" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "local.d" "00-security-settings"
add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "{{{ dconf_gdm_dir }}}" "00-security-settings"
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
# disruption = medium
- name: "Disable GNOME3 Automounting - automount-open"
community.general.ini_file:
dest: /etc/dconf/db/local.d/00-security-settings
dest: /etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings
section: org/gnome/desktop/media-handling
option: automount-open
value: "false"
Expand All @@ -15,20 +15,14 @@

- name: "Prevent user modification of GNOME3 Automounting - automount-open"
ansible.builtin.lineinfile:
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock
regexp: '^/org/gnome/desktop/media-handling/automount-open$'
line: '/org/gnome/desktop/media-handling/automount-open'
create: yes
register: result_lineinfile

# apply fix for enable_dconf_user_profile, OVAL checks it
{{% if product in ['sle15', 'sle16'] %}}
- name: "Configure GNOME3 DConf User Profile"
ansible.builtin.lineinfile:
dest: "/etc/dconf/profile/gdm"
line: "user-db:user\nsystem-db:gdm"
create: yes
state: present
{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

- name: Dconf Update
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,5 @@
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount-open", "false", "local.d", "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount-open", "local.d", "00-security-settings-lock") }}}
{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount-open", "false", dconf_gdm_dir , "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount-open", dconf_gdm_dir, "00-security-settings-lock") }}}
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_automount_open"
version="1">
<ind:path>/etc/dconf/db/local.d/</ind:path>
<ind:path>/etc/dconf/db/{{{ dconf_gdm_dir }}}/</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount-open=false$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
Expand All @@ -33,7 +33,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_prevent_user_gnome_automount_open"
version="1">
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
<ind:path>/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ description: |-
The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount-open within GNOME3, add or set
<tt>automount-open</tt> to <tt>false</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
<tt>automount-open</tt> to <tt>false</tt> in <tt>/etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings</tt>.
For example:
<pre>[org/gnome/desktop/media-handling]
automount-open=false</pre>
Once the settings have been added, add a lock to
<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
<tt>/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock</tt> to prevent user modification.
For example:
<pre>/org/gnome/desktop/media-handling/automount-open</pre>
After the settings have been set, run <tt>dconf update</tt>.
Expand Down Expand Up @@ -52,7 +52,7 @@ ocil: |-
<pre>$ gsettings get org.gnome.desktop.media-handling automount-open</pre>
If properly configured, the output for <tt>automount-open</tt>should be <tt>false</tt>.
To ensure that users cannot enable automount opening in GNOME3, run the following:
<pre>$ grep 'automount-open' /etc/dconf/db/local.d/locks/*</pre>
<pre>$ grep 'automount-open' /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/*</pre>
If properly configured, the output for <tt>automount-open</tt> should be <tt>/org/gnome/desktop/media-handling/automount-open</tt>


Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,5 @@ install_dconf_and_gdm_if_needed
clean_dconf_settings

add_dconf_profiles
add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "local.d" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "local.d" "00-security-settings"


add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "{{{ dconf_gdm_dir }}}" "00-security-settings"
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,5 @@
install_dconf_and_gdm_if_needed
clean_dconf_settings

add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "local.d" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "local.d" "00-security-settings"
add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "{{{ dconf_gdm_dir }}}" "00-security-settings"
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux
# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
# reboot = false
# strategy = unknown
# complexity = low
# disruption = medium
- name: "Disable GNOME3 Automounting - autorun-never"
community.general.ini_file:
dest: /etc/dconf/db/local.d/00-security-settings
dest: /etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings
section: org/gnome/desktop/media-handling
option: autorun-never
value: "true"
Expand All @@ -15,7 +15,7 @@

- name: "Prevent user modification of GNOME3 Automounting - autorun-never"
ansible.builtin.lineinfile:
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock
regexp: '^/org/gnome/desktop/media-handling/autorun-never$'
line: '/org/gnome/desktop/media-handling/autorun-never'
create: yes
Expand All @@ -24,3 +24,7 @@
- name: Dconf Update
ansible.builtin.command: dconf update
when: result_ini is changed or result_lineinfile is changed

{{% if product in ['sle15', 'sle16'] %}}
{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,9 @@
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "autorun-never", "true", "local.d", "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "autorun-never", "local.d", "00-security-settings-lock") }}}
{{% if product in ['sle15', 'sle16'] %}}
{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
{{% endif %}}

{{{ bash_dconf_settings("org/gnome/desktop/media-handling", "autorun-never", "true", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}}
{{{ bash_dconf_lock("org/gnome/desktop/media-handling", "autorun-never", dconf_gdm_dir, "00-security-settings-lock") }}}
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_autorun"
version="1">
<ind:path>/etc/dconf/db/local.d/</ind:path>
<ind:path>/etc/dconf/db/{{{ dconf_gdm_dir }}}/</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
Expand All @@ -33,7 +33,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_prevent_user_gnome_autorun"
version="1">
<ind:path>/etc/dconf/db/local.d/locks/</ind:path>
<ind:path>/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ checktext: |-
fixtext: |-
Configure the GNOME desktop to not allow a user to change the setting that disables autorun on removable media.

Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification:
Add the following line to "/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock" to prevent user modification:

/org/gnome/desktop/media-handling/autorun-never

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ description: |-
The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable autorun-never within GNOME3, add or set
<tt>autorun-never</tt> to <tt>true</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
<tt>autorun-never</tt> to <tt>true</tt> in <tt>/etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings</tt>.
For example:
<pre>[org/gnome/desktop/media-handling]
autorun-never=true</pre>
Once the settings have been added, add a lock to
<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
<tt>/etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock</tt> to prevent user modification.
For example:
<pre>/org/gnome/desktop/media-handling/autorun-never</pre>
After the settings have been set, run <tt>dconf update</tt>.
Expand Down Expand Up @@ -51,7 +51,7 @@ ocil: |-
<pre>$ gsettings get org.gnome.desktop.media-handling autorun-never</pre>
If properly configured, the output for <tt>autorun-never</tt>should be <tt>true</tt>.
To ensure that users cannot enable autorun in GNOME3, run the following:
<pre>$ grep 'autorun-never' /etc/dconf/db/local.d/locks/*</pre>
<pre>$ grep 'autorun-never' /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/*</pre>
If properly configured, the output for <tt>autorun-never</tt> should be <tt>/org/gnome/desktop/media-handling/autorun-never</tt>


Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,5 @@ install_dconf_and_gdm_if_needed
clean_dconf_settings

add_dconf_profiles
add_dconf_setting "org/gnome/desktop/media-handling" "autorun-never" "true" "local.d" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "autorun-never" "local.d" "00-security-settings"
add_dconf_setting "org/gnome/desktop/media-handling" "autorun-never" "true" "{{{ dconf_gdm_dir }}}" "00-security-settings"
add_dconf_lock "org/gnome/desktop/media-handling" "autorun-never" "{{{ dconf_gdm_dir }}}" "00-security-settings"
Loading
Loading