Description of problem:
Rules that check for GNOME dconf configuration are reading and enforcing content of configuration files on the file system in `/etc/dconf/` directory tree. That content is only prescription for `dconf update` to fill in the binary dconf GVariant database. At the moment, there is no OVAL check to verify contents of the real binary DB. So OpenSCAP scanner using SCAP Security Guide cannot identify if the machine is hardened or not.
So "pass" is possibly false negative.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
0. let's use this rule https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-C2S.html#xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
1. yum install openscap-scanner scap-security-guide
2. Follow the guide, so add or edit `banner-message-enable=true` to /etc/dconf/db/gdm.d/00-security-settings:
2a. Add `/org/gnome/login-screen/banner-message-enable` to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock`
3. run scan `oscap xccdf eval --profile C2S --rule xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
4. run `dconf update`
5. repeat #3
6. run `dconf write org/gnome/login-screen/banner-message-enable false`
7. repeat #3
Due to OVAL design, we need to either have dconf probe, or dbus probe to truly solve the problem.
Hello Ray, do you have any tips that could work regarding this issue? Basically - in OVAL, we currently have no option to communicate over dbus, or execute commands. Our best bet is reading files on the file system. Is there a way dconf can show db contents continuously on FS? Or are dbus and dconf command line the only ways to get the contents?
hey sorry for the slow response on this.
dconf can be configured to use text based keyfiles as it's data backend:
but that's not the recommended default. It's main purpose is to provide better reliability over NFS.
Note, dconf doesn't use dbus for *reading*. it only uses dconf for writing. so it should be possible to monitor the database if you can add a runtime dependency to libdconf.
Fixed by upstream in https://github.com/ComplianceAsCode/content/pull/3725
And improved user experience in https://github.com/ComplianceAsCode/content/pull/3755