Linux distributions
TMA-ROCKY9-1.8.5
Ensure GDM autorun-never is configured
Deskripsi
The autorun-never setting allows the GNOME Desktop Display Manager to disable autorun through GDM. By using the lockdown mode in dconf, you can prevent users from changing specific settings.
Cara pemeriksaan
Metode audit: Perintah shell
alt0() { command -v gsettings >/dev/null 2>&1 || { echo "step1: gsettings not installed"; return 1; }; o=$(bash -c 'gsettings writable org.gnome.desktop.media-handling autorun-never' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- false || { echo step1: missing false; return 1; }; command -v gsettings >/dev/null 2>&1 || { echo "step2: gsettings not installed"; return 1; }; o=$(bash -c 'gsettings get org.gnome.desktop.media-handling autorun-never' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- true || { echo step2: missing true; return 1; }; }; if alt0; then echo compliant; fi- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
1. Create or edit the file /etc/dconf/profile/user and add the following lines if they do not exist: user-db:user system-db:local Example: #!/usr/bin/env bash { l_dir="/etc/dconf/profile/" [ ! -d "$l_dir" ] && mkdir /etc/dconf/profile/ ! grep -Psq '^\h*user-db:user\b' "$l_dir/user" && \ printf '%s\n' "" "user-db:user" >> "$l_dir/user" ! grep -Psq '^\h*system-db:local\b' "$l_dir/user" && \ sed -ri '/^\s*user-db:user/a system-db:local' "$l_dir/user" } 2. Run the following command to create the /etc/dconf/db/local.d/ and /etc/dconf/db/local.d/locks/ directories if either does not exist: # [ ! -d "/etc/dconf/db/local.d/locks/" ] && mkdir -p /etc/dconf/db/local.d/locks/ 3. Create or edit a file i…
Properti
- Sistem operasi
- rocky-9
- Tag
- cis-convertedlinux
- Referensi
- CIS Rocky Linux 9 Benchmark v3.0.0 - 1.8.5
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target linux