Skip to content

Commit 4e9ff53

Browse files
Change grub2_uefi_password check for SLE platforms behaves similar to existing ubuntu check
1 parent b722e1d commit 4e9ff53

1 file changed

Lines changed: 28 additions & 0 deletions

File tree

  • linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/oval
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<def-group>
2+
<definition class="compliance" id="grub2_uefi_password" version="1">
3+
{{{ oval_metadata("The UEFI grub2 boot loader should have password protection enabled.") }}}
4+
5+
<criteria operator="AND">
6+
<criterion comment="make sure a password is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" test_ref="test_grub2_uefi_password_grubcfg" />
7+
<criterion comment="make sure a superuser is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" test_ref="test_bootloader_uefi_superuser"/>
8+
</criteria>
9+
</definition>
10+
11+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" id="test_bootloader_uefi_superuser" version="2">
12+
<ind:object object_ref="object_bootloader_uefi_superuser" />
13+
</ind:textfilecontent54_test>
14+
<ind:textfilecontent54_object id="object_bootloader_uefi_superuser" version="2">
15+
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
16+
<ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind:pattern>
17+
<ind:instance datatype="int">1</ind:instance>
18+
</ind:textfilecontent54_object>
19+
20+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" id="test_grub2_uefi_password_grubcfg" version="1">
21+
<ind:object object_ref="object_grub2_uefi_password_grubcfg" />
22+
</ind:textfilecontent54_test>
23+
<ind:textfilecontent54_object id="object_grub2_uefi_password_grubcfg" version="1">
24+
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
25+
<ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
26+
<ind:instance datatype="int">1</ind:instance>
27+
</ind:textfilecontent54_object>
28+
</def-group>

0 commit comments

Comments
 (0)