From c88dd0344af4cd446094eeb6f01ded28120a66e7 Mon Sep 17 00:00:00 2001 From: Yavor Georgiev Date: Thu, 10 Sep 2026 11:12:00 +0300 Subject: [PATCH 1/9] Add OpenSUSE Leap 16 product definition --- CMakeLists.txt | 5 +++ build_product | 1 + products/opensuse/product.yml | 4 --- products/opensuse16/CMakeLists.txt | 6 ++++ products/opensuse16/product.yml | 40 +++++++++++++++++++++++ products/opensuse16/profiles/stig.profile | 16 +++++++++ ssg/constants.py | 5 +-- 7 files changed, 71 insertions(+), 6 deletions(-) create mode 100644 products/opensuse16/CMakeLists.txt create mode 100644 products/opensuse16/product.yml create mode 100644 products/opensuse16/profiles/stig.profile diff --git a/CMakeLists.txt b/CMakeLists.txt index c58ed4c74078..466949ce0a03 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -110,6 +110,7 @@ option(SSG_PRODUCT_OL10 "If enabled, the Oracle Linux 10 SCAP content will be bu option(SSG_PRODUCT_OPENEMBEDDED "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENEULER2203 "If enabled, the openEuler 22.03 LTS content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_OPENSUSE "If enabled, the openSUSE SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) +option(SSG_PRODUCT_OPENSUSE16 "If enabled, the openSUSE Leap 16 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_RHCOS4 "If enabled, the RHCOS4 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_RHEL8 "If enabled, the RHEL8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_RHEL9 "If enabled, the RHEL9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) @@ -349,6 +350,7 @@ message(STATUS "Oracle Linux 10: ${SSG_PRODUCT_OL10}") message(STATUS "OpenEmbedded: ${SSG_PRODUCT_OPENEMBEDDED}") message(STATUS "openEuler 22.03 LTS: ${SSG_PRODUCT_OPENEULER2203}") message(STATUS "openSUSE: ${SSG_PRODUCT_OPENSUSE}") +message(STATUS "openSUSE Leap 16: ${SSG_PRODUCT_OPENSUSE16}") message(STATUS "RHEL 8: ${SSG_PRODUCT_RHEL8}") message(STATUS "RHEL 9: ${SSG_PRODUCT_RHEL9}") message(STATUS "RHEL 10: ${SSG_PRODUCT_RHEL10}") @@ -464,6 +466,9 @@ endif() if(SSG_PRODUCT_OPENSUSE) add_subdirectory("products/opensuse" "opensuse") endif() +if(SSG_PRODUCT_OPENSUSE16) + add_subdirectory("products/opensuse16" "opensuse16") +endif() if(SSG_PRODUCT_RHEL8) add_subdirectory("products/rhel8" "rhel8") endif() diff --git a/build_product b/build_product index b2d0434b195e..59b004574f25 100755 --- a/build_product +++ b/build_product @@ -373,6 +373,7 @@ all_cmake_products=( OPENEMBEDDED OPENEULER2203 OPENSUSE + OPENSUSE16 RHCOS4 RHEL8 RHEL9 diff --git a/products/opensuse/product.yml b/products/opensuse/product.yml index bb8e0cf22627..4ee936c0f9f6 100644 --- a/products/opensuse/product.yml +++ b/products/opensuse/product.yml @@ -17,10 +17,6 @@ cpes: name: "cpe:/o:opensuse:leap:15" title: "openSUSE Leap 15" check_id: installed_OS_is_opensuse_leap15 - - opensuse-16: - name: "cpe:/o:opensuse:leap:16" - title: "openSUSE Leap 16" - check_id: installed_OS_is_opensuse_leap16 - opensuse-tumbleweed: name: "cpe:/o:opensuse:tumbleweed" title: "openSUSE Tumbleweed" diff --git a/products/opensuse16/CMakeLists.txt b/products/opensuse16/CMakeLists.txt new file mode 100644 index 000000000000..48fbdbf2bae1 --- /dev/null +++ b/products/opensuse16/CMakeLists.txt @@ -0,0 +1,6 @@ +# Sometimes our users will try to do: "cd opensuse16; cmake ." That needs to error in a nice way. +if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") + message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") +endif() + +ssg_build_product("opensuse16") diff --git a/products/opensuse16/product.yml b/products/opensuse16/product.yml new file mode 100644 index 000000000000..3932b92d6e81 --- /dev/null +++ b/products/opensuse16/product.yml @@ -0,0 +1,40 @@ +product: opensuse16 +full_name: openSUSE 16 +type: platform + +major_version_ordinal: 16 +families: + - suse + +benchmark_id: OPENSUSE-16 +benchmark_root: "../../linux_os/guide" + +profiles_root: "./profiles" + +pkg_manager: "zypper" +pkg_manager_config_file: "/etc/zypp/zypp.conf" + +init_system: "systemd" +sshd_distributed_config: "true" +aide_bin_path: "/usr/bin/aide" +audisp_conf_path: "/etc/audit" + +cpes_root: "../../shared/applicability" +cpes: + - opensuse16: + name: "cpe:/o:opensuse:leap:16" + title: "openSUSE Leap 16" + check_id: installed_OS_is_opensuse_leap16 + +platform_package_overrides: + login_defs: "shadow" + grub2: "grub2" + sssd: "sssd" + crontabs: "cronie" + passwd: "shadow" + dhcp-client: "dhcpcd" + +dconf_gdm_dir: "gdm.d" + +sysctl_remediate_drop_in_file: "true" +journald_conf_dir_path: /etc/systemd/journal.conf.d diff --git a/products/opensuse16/profiles/stig.profile b/products/opensuse16/profiles/stig.profile new file mode 100644 index 000000000000..ed3ccc8250a8 --- /dev/null +++ b/products/opensuse16/profiles/stig.profile @@ -0,0 +1,16 @@ +documentation_complete: true + +reference: https://www.cyber.mil/stigs/downloads/ + +title: 'General Purpose Operating System Security Profile for openSUSE Leap 16' + +description: |- + General Purpose Operating System Security Profile for openSUSE Leap 16 + +selections: + - srg_gpos:all + - package_audit-audispd-plugins_installed + - '!aide_periodic_cron_checking' + - '!aide_verify_ext_attributes' + - '!enable_fips_mode' + - '!package_subscription-manager_installed' diff --git a/ssg/constants.py b/ssg/constants.py index 013a9ac5abcf..6bf8b7c5c8e4 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -55,7 +55,7 @@ 'rhcos4', 'ol7', 'ol8', 'ol9', 'ol10', 'openeuler2203', - 'opensuse', + 'opensuse', 'opensuse16', 'openembedded', 'rhel8', 'rhel9', 'rhel10', 'rhv4', @@ -235,6 +235,7 @@ "Oracle Linux 10": "ol10", "openEuler 2203": "openeuler2203", "openSUSE": "opensuse", + "openSUSE 16": "opensuse16", "Red Hat Enterprise Linux 8": "rhel8", "Red Hat Enterprise Linux 9": "rhel9", "Red Hat Enterprise Linux 10": "rhel10", @@ -313,7 +314,7 @@ "multi_platform_kylinserver": ["kylinserver10"], "multi_platform_kylinsecserver": ["kylinsecserver6"], "multi_platform_openeuler": ["openeuler2203"], - "multi_platform_opensuse": ["opensuse"], + "multi_platform_opensuse": ["opensuse", "opensuse16"], "multi_platform_ol": ["ol7", "ol8", "ol9", "ol10"], "multi_platform_ocp": ["ocp4"], "multi_platform_rhcos": ["rhcos4"], From efc6e3ada49934fd2181cc5fdab594631e9cd6a2 Mon Sep 17 00:00:00 2001 From: Yavor Georgiev Date: Thu, 10 Sep 2026 11:13:20 +0300 Subject: [PATCH 2/9] Add support for opensuse leap 16 in applicability checks --- shared/applicability/oval/system_with_kernel.xml | 4 ++-- shared/applicability/package.yml | 10 +++++++--- shared/applicability/system_with_kernel.yml | 4 ++-- shared/macros/10-bash.jinja | 4 ++-- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/shared/applicability/oval/system_with_kernel.xml b/shared/applicability/oval/system_with_kernel.xml index 421715cb237c..5c4a42cf857f 100644 --- a/shared/applicability/oval/system_with_kernel.xml +++ b/shared/applicability/oval/system_with_kernel.xml @@ -6,7 +6,7 @@ {{% if "ol" in families %}} {{% endif %}} - {{% if 'sle' in product or 'slmicro' in product %}} + {{% if 'suse' in families %}} {{% endif %}} @@ -14,7 +14,7 @@ {{% if 'debian' in product or 'ubuntu' in product %}} {{{ oval_test_package_installed(package="linux-base", test_id="inventory_test_kernel_installed") }}} -{{% elif 'sle' in product or 'slmicro' in product %}} +{{% elif 'suse' in families %}} {{{ oval_test_package_installed(package="kernel-default", test_id="inventory_test_kernel_installed") }}} {{{ oval_test_package_installed(package="kernel-default-base", test_id="inventory_test_kernel_default_base_installed") }}} {{{ oval_test_package_installed(package="kernel-azure", test_id="inventory_test_kernel_azure_installed") }}} diff --git a/shared/applicability/package.yml b/shared/applicability/package.yml index 1985807da25c..ee6ec07538a8 100644 --- a/shared/applicability/package.yml +++ b/shared/applicability/package.yml @@ -51,15 +51,19 @@ args: iptables: pkgname: iptables krb5-libs: + {{% if 'suse' in families %}} + pkgname: krb5 + {{% else %}} pkgname: krb5-libs + {{% endif %}} libpwquality: - {{% if 'debian' in product or 'sle' in product or 'slmicro' in product or 'ubuntu' in product %}} + {{% if 'debian' in product or 'suse' in families or 'ubuntu' in product %}} pkgname: libpwquality1 {{% else %}} pkgname: libpwquality {{% endif %}} libreswan: - {{% if product in ["sle15", "sle16"] %}} + {{% if product in ["opensuse16", "sle15", "sle16"] %}} pkgname: strongswan-ipsec {{% else %}} pkgname: libreswan @@ -123,7 +127,7 @@ args: pkgname: rsh-server shadow-utils: {{% if pkg_system == "rpm" %}} - {{% if 'sle' in product or 'slmicro' in product or product in ["kylinserver10", "kylinsecserver6", "openeuler2203"] %}} + {{% if 'suse' in families or product in ["kylinserver10", "kylinsecserver6", "openeuler2203"] %}} pkgname: shadow {{% elif product in ["openembedded"] %}} pkgname: shadow-base diff --git a/shared/applicability/system_with_kernel.yml b/shared/applicability/system_with_kernel.yml index f41d8ad79539..c77adaaad284 100644 --- a/shared/applicability/system_with_kernel.yml +++ b/shared/applicability/system_with_kernel.yml @@ -16,7 +16,7 @@ title: Bare-metal systems, virtual machines, bootc container images, running boo # was set in past. check_id: system_with_kernel {{% if pkg_system == "rpm" %}} -{{% if "sle" in product or "slmicro" in product %}} +{{% if 'suse' in families %}} bash_conditional: >- rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base || @@ -41,7 +41,7 @@ bash_conditional: >- {{% endif %}} {{% if "debian" in product or "ubuntu" in product %}} ansible_conditional: '"linux-base" in ansible_facts.packages' -{{% elif "sle" in product or "slmicro" in product %}} +{{% elif 'suse' in families %}} ansible_conditional: >- "kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages or diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja index 116f5fc24bea..0d5023e38fde 100644 --- a/shared/macros/10-bash.jinja +++ b/shared/macros/10-bash.jinja @@ -2863,7 +2863,7 @@ This macro creates a Bash conditional which checks the system architecture in /p #}} {{% macro bash_copy_distro_defaults(source, destination) -%}} -{{% if product in ["sle16", "slmicro6"] %}} +{{% if product in ["opensuse16", "sle16", "slmicro6"] %}} if ! [ -e "{{{ destination }}}" ] ; then cp -p "{{{ source }}}" "{{{ destination }}}" fi @@ -2887,7 +2887,7 @@ fi {{%- set line_regex_replace = "^" + parameter -%}} {{%- set login_defs_d_config_dir = "/".join(login_defs_drop_in_path.split("/")[:-1]) -%}} -{{% if product in [ 'slmicro6', 'sle16' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ bash_copy_distro_defaults(login_defs_defaults_path, login_defs_path) }}} {{% endif %}} From 86dd80dd10550811126ad3562dc7e3b92aef8159 Mon Sep 17 00:00:00 2001 From: Yavor Georgiev Date: Thu, 10 Sep 2026 11:14:20 +0300 Subject: [PATCH 3/9] Add support for the OpenSUSE Leap 16 in testing infrastructure --- Dockerfiles/test_suite-opensuse16 | 22 ++++ tests/data/product_stability/opensuse.yml | 4 - tests/data/product_stability/opensuse16.yml | 123 ++++++++++++++++++++ 3 files changed, 145 insertions(+), 4 deletions(-) create mode 100644 Dockerfiles/test_suite-opensuse16 create mode 100644 tests/data/product_stability/opensuse16.yml diff --git a/Dockerfiles/test_suite-opensuse16 b/Dockerfiles/test_suite-opensuse16 new file mode 100644 index 000000000000..98ea7bd18306 --- /dev/null +++ b/Dockerfiles/test_suite-opensuse16 @@ -0,0 +1,22 @@ +FROM registry.opensuse.org/opensuse/leap:16 + +ENV AUTH_KEYS=/root/.ssh/authorized_keys + +ARG CLIENT_PUBLIC_KEY +ARG ADDITIONAL_PACKAGES + +RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/16.0/repo/oss/ leap-oss +RUN zypper refresh + +RUN true \ + && zypper --non-interactive install openssh-clients openssh-server openscap-utils \ + python313 python313-rpm python313-pip tar gawk ansible \ + $ADDITIONAL_PACKAGES \ +&& true + +RUN true \ + && for key_type in rsa ecdsa; do ssh-keygen -N '' -t $key_type -f /etc/ssh/ssh_host_${key_type}_key; done \ + && mkdir -p /root/.ssh \ + && printf "%s\n" "$CLIENT_PUBLIC_KEY" >> "$AUTH_KEYS" \ + && chmod og-rw /root/.ssh "$AUTH_KEYS" \ +&& true diff --git a/tests/data/product_stability/opensuse.yml b/tests/data/product_stability/opensuse.yml index 41f37e3fe1dc..1e4cf0216836 100644 --- a/tests/data/product_stability/opensuse.yml +++ b/tests/data/product_stability/opensuse.yml @@ -30,10 +30,6 @@ cpes: check_id: installed_OS_is_opensuse_leap15 name: cpe:/o:opensuse:leap:15 title: openSUSE Leap 15 - - opensuse-16: - check_id: installed_OS_is_opensuse_leap16 - name: cpe:/o:opensuse:leap:16 - title: openSUSE Leap 16 - opensuse-tumbleweed: check_id: installed_OS_is_opensuse name: cpe:/o:opensuse:tumbleweed diff --git a/tests/data/product_stability/opensuse16.yml b/tests/data/product_stability/opensuse16.yml new file mode 100644 index 000000000000..c3126b470d35 --- /dev/null +++ b/tests/data/product_stability/opensuse16.yml @@ -0,0 +1,123 @@ +aide_bin_path: /usr/bin/aide +aide_conf_path: /etc/aide.conf +aide_audit_binaries: + - auditctl + - auditd + - ausearch + - aureport + - audispd + - augenrules +audisp_conf_path: /etc/audit +audit_binaries: + - /sbin/auditctl + - /sbin/aureport + - /sbin/ausearch + - /sbin/auditd + - /sbin/augenrules + - /sbin/audisp-syslog +audit_watches_style: legacy +auid: 1000 +basic_properties_derived: true +benchmark_id: OPENSUSE-16 +benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' +chrony_conf_path: /etc/chrony.conf +chrony_d_path: /etc/chrony.d/ +cpes: + - opensuse16: + check_id: installed_OS_is_opensuse_leap16 + name: cpe:/o:opensuse:leap:16 + title: openSUSE Leap 16 +cpes_root: ../../shared/applicability +dconf_gdm_dir: gdm.d +dynamic_uid_max: 65519 +dynamic_uid_min: 61184 +faillock_path: /var/run/faillock +families: + - suse +full_name: openSUSE Leap 16 +gid_min: 1000 +groups: {} +grub2_boot_path: /boot/grub2 +grub2_uefi_boot_path: /boot/grub2 +grub_helper_executable: grub2-mkconfig +init_system: systemd +journald_conf_dir_path: /etc/systemd/journal.d +login_defs_defaults_path: /usr/etc/login.defs +login_defs_drop_in_path: /etc/login.defs.d/oscap.login.defs +login_defs_path: /etc/login.defs +major_version_ordinal: 16 +nobody_gid: 65534 +nobody_uid: 65534 +openssh_client_crypto_policy_config_file: /etc/crypto-policies/back-ends/openssh.config +openssh_server_crypto_policy_config_file: /etc/crypto-policies/back-ends/opensshserver.config +pam_faillock_conf_path: /etc/security/faillock.conf +pkg_manager: zypper +pkg_manager_config_file: /etc/zypp/zypp.conf +pkg_system: rpm +platform_package_overrides: + aarch64_arch: null + crontabs: cronie + dhcp-client: dhcpcd + grub2: grub2 + login_defs: shadow + no_ovirt: null + non-uefi: null + not_aarch64_arch: null + not_s390x_arch: null + ovirt: null + passwd: shadow + s390x_arch: null + sssd: sssd + sssd-ldap: null + uefi: null + zipl: s390utils-base +product: opensuse16 +profiles_root: ./profiles +pwhistory_path: /usr/etc/security/pwhistory.conf +pwquality_path: /etc/security/pwquality.conf +reference_uris: + anssi: https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf + app-srg: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=application-servers + app-srg-ctr: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security + bsi: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf + cis-csc: https://www.cisecurity.org/controls/ + cjis: https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf + cobit5: https://www.isaca.org/resources/cobit + cui: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf + dcid: not_officially_available + disa: https://www.cyber.mil/stigs/cci/ + hipaa: https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf + isa-62443-2009: https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat + isa-62443-2013: https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu + ism: https://www.cyber.gov.au/acsc/view-all-content/ism + iso27001-2013: https://www.iso.org/contents/data/standard/05/45/54534.html + nerc-cip: https://www.nerc.com/standards/reliability-standards/cip + nist: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf + nist-csf: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf + os-srg: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os + ospp: https://www.niap-ccevs.org/Profile/PP.cfm + pcidss: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf + pcidss4: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf + stigid: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux + stigref: https://www.cyber.mil/stigs/srg-stig-tools/ + stigref_vulnerability_id: https://www.cyber.mil/stigs/srg-stig-tools#vulnerability_id +rsyslog_cafile: /etc/pki/tls/cert.pem +ssh_client_config_dir: /etc/ssh/ssh_config.d +ssh_client_main_config_file: /etc/ssh/ssh_config +sshd_config_base_dir: /usr/etc/ssh +sshd_config_dir: /etc/ssh/sshd_config.d +sshd_distributed_config: 'true' +sshd_hardening_config_basename: 00-complianceascode-hardening.conf +sshd_main_config_file: /usr/etc/ssh/sshd_config +sshd_runtime_check: 'false' +sshd_sysconfig_file: /etc/sysconfig/sshd +sysctl_remediate_drop_in_file: 'true' +target_oval_version: + - 5 + - 11 +target_oval_version_str: '5.11' +type: platform +uid_min: 1000 +xwindows_packages: + - xwayland From 09c7834a1b60b9d79c0dfa80b5a691455ab09779 Mon Sep 17 00:00:00 2001 From: Yavor Georgiev Date: Thu, 10 Sep 2026 11:15:15 +0300 Subject: [PATCH 4/9] Add support for OpenSUSE Leap 16 in some generic checks/remediations --- product_properties/10-aide-audit.yml | 9 ++++++++- product_properties/10-audit-binaries.yml | 11 +++++++++++ product_properties/10-pwhistory-conf.yml | 2 +- shared/templates/package_installed/bash.template | 2 +- shared/templates/service_disabled/bash.template | 2 +- shared/templates/service_enabled/bash.template | 2 +- shared/templates/sshd_lineinfile/ansible.template | 2 +- shared/templates/sshd_lineinfile/bash.template | 2 +- .../templates/sudo_defaults_option/ansible.template | 2 +- shared/templates/sudo_defaults_option/bash.template | 2 +- shared/templates/sudo_defaults_option/oval.template | 4 ++-- shared/templates/sysctl/ansible.template | 2 +- shared/templates/sysctl/bash.template | 4 ++-- 13 files changed, 32 insertions(+), 14 deletions(-) diff --git a/product_properties/10-aide-audit.yml b/product_properties/10-aide-audit.yml index 086678a1c9fe..1179abfb9707 100644 --- a/product_properties/10-aide-audit.yml +++ b/product_properties/10-aide-audit.yml @@ -4,7 +4,7 @@ default: - "auditd" - "ausearch" - "aureport" - {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora'] %}} + {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora', 'opensuse'] %}} - "autrace" {{% endif %}} {{% if 'rhel' not in product and 'ol' not in families and 'debian' not in families and 'ubuntu' not in families and 'almalinux' not in product %}} @@ -14,3 +14,10 @@ default: - "rsyslogd" {{% endif %}} - "augenrules" + {{% if 'suse' in families %}} + - "audisp-syslog" + {{% endif %}} + {{% if product in ['opensuse16', 'sle16'] %}} + - audisp-remote + - audispd-zos-remote + {{% endif %}} diff --git a/product_properties/10-audit-binaries.yml b/product_properties/10-audit-binaries.yml index f58139679ce5..d98512ac07cf 100644 --- a/product_properties/10-audit-binaries.yml +++ b/product_properties/10-audit-binaries.yml @@ -29,3 +29,14 @@ overrides: - /usr/sbin/augenrules - /usr/sbin/audisp-syslog {{% endif %}} +{{% if product in ['opensuse16', 'sle16'] %}} + audit_binaries: + - /usr/sbin/auditctl + - /usr/sbin/aureport + - /usr/sbin/ausearch + - /usr/sbin/auditd + - /usr/sbin/augenrules + - /usr/sbin/audisp-syslog + - /usr/sbin/audisp-remote + - /usr/sbin/audispd-zos-remote +{{% endif %}} diff --git a/product_properties/10-pwhistory-conf.yml b/product_properties/10-pwhistory-conf.yml index b94e4c5461e8..47af3c534be2 100644 --- a/product_properties/10-pwhistory-conf.yml +++ b/product_properties/10-pwhistory-conf.yml @@ -2,6 +2,6 @@ default: pwhistory_path: "/etc/security/pwhistory.conf" overrides: -{{% if product == 'sle16' %}} +{{% if product in ['opensuse16', 'sle16'] %}} pwhistory_path: "/usr/etc/security/pwhistory.conf" {{% endif %}} diff --git a/shared/templates/package_installed/bash.template b/shared/templates/package_installed/bash.template index dcd451ddbdef..4d62d6a48998 100644 --- a/shared/templates/package_installed/bash.template +++ b/shared/templates/package_installed/bash.template @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro,multi_platform_debian,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = false # strategy = enable # complexity = low diff --git a/shared/templates/service_disabled/bash.template b/shared/templates/service_disabled/bash.template index 9516356e4871..5e3bbec1f51c 100644 --- a/shared/templates/service_disabled/bash.template +++ b/shared/templates/service_disabled/bash.template @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_debian +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = false # strategy = disable # complexity = low diff --git a/shared/templates/service_enabled/bash.template b/shared/templates/service_enabled/bash.template index 4e207a79d75b..bbf1ef3d6530 100644 --- a/shared/templates/service_enabled/bash.template +++ b/shared/templates/service_enabled/bash.template @@ -1,4 +1,4 @@ -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_debian +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = false # strategy = enable # complexity = low diff --git a/shared/templates/sshd_lineinfile/ansible.template b/shared/templates/sshd_lineinfile/ansible.template index 97d7a94a8ade..fd943342e1e0 100644 --- a/shared/templates/sshd_lineinfile/ansible.template +++ b/shared/templates/sshd_lineinfile/ansible.template @@ -4,7 +4,7 @@ # complexity = low # disruption = low -{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}} - name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists ansible.builtin.stat: diff --git a/shared/templates/sshd_lineinfile/bash.template b/shared/templates/sshd_lineinfile/bash.template index 2ec3a9ac9136..9dd4257e80b8 100644 --- a/shared/templates/sshd_lineinfile/bash.template +++ b/shared/templates/sshd_lineinfile/bash.template @@ -4,7 +4,7 @@ # complexity = low # disruption = low -{{% if product in ['sle16', 'slmicro6'] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}} {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}} {{% endif %}} diff --git a/shared/templates/sudo_defaults_option/ansible.template b/shared/templates/sudo_defaults_option/ansible.template index 3aaed64fa354..6e2fbec5ca16 100644 --- a/shared/templates/sudo_defaults_option/ansible.template +++ b/shared/templates/sudo_defaults_option/ansible.template @@ -4,7 +4,7 @@ # complexity = low # disruption = low -{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ ansible_copy_distro_defaults('/usr/etc/sudoers', '/etc/sudoers', rule_title=rule_title) }}} {{{ ansible_lineinfile( diff --git a/shared/templates/sudo_defaults_option/bash.template b/shared/templates/sudo_defaults_option/bash.template index ae1afe7cc6aa..a0e246d2159e 100644 --- a/shared/templates/sudo_defaults_option/bash.template +++ b/shared/templates/sudo_defaults_option/bash.template @@ -8,7 +8,7 @@ {{{ bash_instantiate_variables(VARIABLE_NAME) }}} {{% endif %}} -{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ bash_copy_distro_defaults("/usr/etc/sudoers", "/etc/sudoers") }}} {{{ lineinfile_absent("/etc/sudoers", "^\s*@includedir\s*/usr/etc/sudoers\.d", sed_path_separator="#", rule_id=rule_id) }}} {{% endif %}} diff --git a/shared/templates/sudo_defaults_option/oval.template b/shared/templates/sudo_defaults_option/oval.template index ae99a13560f0..c4b62980dde5 100644 --- a/shared/templates/sudo_defaults_option/oval.template +++ b/shared/templates/sudo_defaults_option/oval.template @@ -2,7 +2,7 @@ {{{ oval_metadata("Checks sudoers Defaults " + OPTION + " configuration", rule_title=rule_title) }}} - {{% if product in [ 'sle16', 'slmicro6' ] %}} + {{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} @@ -29,7 +29,7 @@ {{% endif %}} - {{% if product in [ 'sle16', 'slmicro6' ] %}} + {{% if product in ['opensuse16', 'sle16', 'slmicro6'] %}} {{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}} {{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}} {{% endif %}} diff --git a/shared/templates/sysctl/ansible.template b/shared/templates/sysctl/ansible.template index 76b97a10aaf0..3ab92507f468 100644 --- a/shared/templates/sysctl/ansible.template +++ b/shared/templates/sysctl/ansible.template @@ -10,7 +10,7 @@ - name: {{{ rule_title }}} - Set fact for sysctl paths ansible.builtin.set_fact: -{{% if 'sle' in product or 'slmicro' in product %}} +{{% if 'suse' in families %}} sysctl_paths: - "/run/sysctl.d/" - "/etc/sysctl.d/" diff --git a/shared/templates/sysctl/bash.template b/shared/templates/sysctl/bash.template index fe6068fb8bd1..59e8d0138382 100644 --- a/shared/templates/sysctl/bash.template +++ b/shared/templates/sysctl/bash.template @@ -1,11 +1,11 @@ -# platform = multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu +# platform = multi_platform_almalinux,multi_platform_debian,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # reboot = true # strategy = disable # complexity = low # disruption = medium # Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/sysctl.d/*.conf files -{{% if product in [ "sle12", "sle15", "slmicro5", "slmicro6"] %}} +{{% if 'suse' in families %}} for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf; do {{% elif product in [ "ubuntu2204", "ubuntu2404"] %}} for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /etc/ufw/sysctl.conf; do From 7b5a12236e0ffaaac3fde4d8677a4e4ce1e5ba74 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Sun, 13 Sep 2026 15:51:17 +0300 Subject: [PATCH 5/9] add xwayland as xwindows package to product definition --- products/opensuse16/product.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/products/opensuse16/product.yml b/products/opensuse16/product.yml index 3932b92d6e81..f9b2fdd48460 100644 --- a/products/opensuse16/product.yml +++ b/products/opensuse16/product.yml @@ -37,4 +37,6 @@ platform_package_overrides: dconf_gdm_dir: "gdm.d" sysctl_remediate_drop_in_file: "true" -journald_conf_dir_path: /etc/systemd/journal.conf.d +journald_conf_dir_path: /etc/systemd/journald.conf.d +xwindows_packages: + - xwayland From 1782920dde06a888db4e721b3dbbbd661582bd76 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Sun, 13 Sep 2026 15:52:27 +0300 Subject: [PATCH 6/9] Adapt aide related package definitions for opensuses16 and sle related platforms --- product_properties/10-aide-audit.yml | 4 +-- tests/data/product_stability/opensuse16.yml | 27 ++++++++++++--------- tests/data/product_stability/sle15.yml | 1 + tests/data/product_stability/sle16.yml | 17 ++++++++----- tests/data/product_stability/slmicro5.yml | 1 + tests/data/product_stability/slmicro6.yml | 1 + 6 files changed, 32 insertions(+), 19 deletions(-) diff --git a/product_properties/10-aide-audit.yml b/product_properties/10-aide-audit.yml index 1179abfb9707..45626c89ae98 100644 --- a/product_properties/10-aide-audit.yml +++ b/product_properties/10-aide-audit.yml @@ -4,7 +4,7 @@ default: - "auditd" - "ausearch" - "aureport" - {{% if product not in ['rhel10', 'ol10', 'sle16', 'fedora', 'opensuse'] %}} + {{% if product not in ['rhel10', 'ol10', 'fedora', 'opensuse16', 'sle16'] %}} - "autrace" {{% endif %}} {{% if 'rhel' not in product and 'ol' not in families and 'debian' not in families and 'ubuntu' not in families and 'almalinux' not in product %}} @@ -14,7 +14,7 @@ default: - "rsyslogd" {{% endif %}} - "augenrules" - {{% if 'suse' in families %}} + {{% if 'suse' in families and product != 'sle12' %}} - "audisp-syslog" {{% endif %}} {{% if product in ['opensuse16', 'sle16'] %}} diff --git a/tests/data/product_stability/opensuse16.yml b/tests/data/product_stability/opensuse16.yml index c3126b470d35..d20606a57acb 100644 --- a/tests/data/product_stability/opensuse16.yml +++ b/tests/data/product_stability/opensuse16.yml @@ -7,14 +7,19 @@ aide_audit_binaries: - aureport - audispd - augenrules + - audisp-syslog + - audisp-remote + - audispd-zos-remote audisp_conf_path: /etc/audit audit_binaries: - - /sbin/auditctl - - /sbin/aureport - - /sbin/ausearch - - /sbin/auditd - - /sbin/augenrules - - /sbin/audisp-syslog + - /usr/sbin/auditctl + - /usr/sbin/aureport + - /usr/sbin/ausearch + - /usr/sbin/auditd + - /usr/sbin/augenrules + - /usr/sbin/audisp-syslog + - /usr/sbin/audisp-remote + - /usr/sbin/audispd-zos-remote audit_watches_style: legacy auid: 1000 basic_properties_derived: true @@ -35,14 +40,14 @@ dynamic_uid_min: 61184 faillock_path: /var/run/faillock families: - suse -full_name: openSUSE Leap 16 +full_name: openSUSE 16 gid_min: 1000 groups: {} grub2_boot_path: /boot/grub2 grub2_uefi_boot_path: /boot/grub2 grub_helper_executable: grub2-mkconfig init_system: systemd -journald_conf_dir_path: /etc/systemd/journal.d +journald_conf_dir_path: /etc/systemd/journald.conf.d login_defs_defaults_path: /usr/etc/login.defs login_defs_drop_in_path: /etc/login.defs.d/oscap.login.defs login_defs_path: /etc/login.defs @@ -84,7 +89,7 @@ reference_uris: cis-csc: https://www.cisecurity.org/controls/ cjis: https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf cobit5: https://www.isaca.org/resources/cobit - cui: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf + cui: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html dcid: not_officially_available disa: https://www.cyber.mil/stigs/cci/ hipaa: https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf @@ -105,11 +110,11 @@ reference_uris: rsyslog_cafile: /etc/pki/tls/cert.pem ssh_client_config_dir: /etc/ssh/ssh_config.d ssh_client_main_config_file: /etc/ssh/ssh_config -sshd_config_base_dir: /usr/etc/ssh +sshd_config_base_dir: /etc/ssh sshd_config_dir: /etc/ssh/sshd_config.d sshd_distributed_config: 'true' sshd_hardening_config_basename: 00-complianceascode-hardening.conf -sshd_main_config_file: /usr/etc/ssh/sshd_config +sshd_main_config_file: /etc/ssh/sshd_config sshd_runtime_check: 'false' sshd_sysconfig_file: /etc/sysconfig/sshd sysctl_remediate_drop_in_file: 'true' diff --git a/tests/data/product_stability/sle15.yml b/tests/data/product_stability/sle15.yml index 053e4a925bc9..ced930519c08 100644 --- a/tests/data/product_stability/sle15.yml +++ b/tests/data/product_stability/sle15.yml @@ -8,6 +8,7 @@ aide_audit_binaries: - autrace - audispd - augenrules + - audisp-syslog audisp_conf_path: /etc/audit audit_binaries: - /usr/sbin/auditctl diff --git a/tests/data/product_stability/sle16.yml b/tests/data/product_stability/sle16.yml index 924e717a813e..2ea7b53cf72a 100644 --- a/tests/data/product_stability/sle16.yml +++ b/tests/data/product_stability/sle16.yml @@ -7,14 +7,19 @@ aide_audit_binaries: - aureport - audispd - augenrules + - audisp-syslog + - audisp-remote + - audispd-zos-remote audisp_conf_path: /etc/audit audit_binaries: - - /sbin/auditctl - - /sbin/aureport - - /sbin/ausearch - - /sbin/auditd - - /sbin/augenrules - - /sbin/audisp-syslog + - /usr/sbin/auditctl + - /usr/sbin/aureport + - /usr/sbin/ausearch + - /usr/sbin/auditd + - /usr/sbin/augenrules + - /usr/sbin/audisp-syslog + - /usr/sbin/audisp-remote + - /usr/sbin/audispd-zos-remote audit_watches_style: legacy auid: 1000 basic_properties_derived: true diff --git a/tests/data/product_stability/slmicro5.yml b/tests/data/product_stability/slmicro5.yml index ceed5211b095..2adda1b2cad5 100644 --- a/tests/data/product_stability/slmicro5.yml +++ b/tests/data/product_stability/slmicro5.yml @@ -8,6 +8,7 @@ aide_audit_binaries: - autrace - audispd - augenrules + - audisp-syslog audisp_conf_path: /etc/audit audit_binaries: - /sbin/auditctl diff --git a/tests/data/product_stability/slmicro6.yml b/tests/data/product_stability/slmicro6.yml index 9603b7a2e30c..57f1a2a4c2ee 100644 --- a/tests/data/product_stability/slmicro6.yml +++ b/tests/data/product_stability/slmicro6.yml @@ -8,6 +8,7 @@ aide_audit_binaries: - autrace - audispd - augenrules + - audisp-syslog audisp_conf_path: /etc/audit audit_binaries: - /sbin/auditctl From 7c14675e9cf3189c60b56eccea28d8c8322417ac Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Mon, 14 Sep 2026 14:04:11 +0300 Subject: [PATCH 7/9] Adapt gnome testing for opensuse leap16 platform --- tests/shared/dconf_test_functions.sh | 2 +- tests/ssg_test_suite/common.py | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/shared/dconf_test_functions.sh b/tests/shared/dconf_test_functions.sh index 06d4ddc2d526..a5626808571b 100644 --- a/tests/shared/dconf_test_functions.sh +++ b/tests/shared/dconf_test_functions.sh @@ -46,7 +46,7 @@ add_dconf_lock(){ # Adds the user profile add_dconf_profiles() { - {{% if 'ubuntu' in product or product in ['sle15', 'sle16'] %}} + {{% if 'ubuntu' in product or product in ['opensuse16', 'sle15', 'sle16'] %}} mkdir -p /etc/dconf/profile echo -e "user-db:user\nsystem-db:gdm" > /etc/dconf/profile/gdm echo -e "user-db:user\nsystem-db:local" > /etc/dconf/profile/user diff --git a/tests/ssg_test_suite/common.py b/tests/ssg_test_suite/common.py index 21cbb8c255ae..0e6cc0f7f450 100644 --- a/tests/ssg_test_suite/common.py +++ b/tests/ssg_test_suite/common.py @@ -512,6 +512,7 @@ def get_cpe_of_tested_os(test_env, log_file): rhel9=("yum", "install", "-y"), rhel10=("dnf", "install", "-y"), sles=("zypper", "install", "-y"), + opensuse=("zypper", "install", "-y"), ubuntu=("DEBIAN_FRONTEND=noninteractive", "apt", "install", "-y"), debian=("DEBIAN_FRONTEND=noninteractive", "apt", "install", "-y"), ) @@ -547,7 +548,7 @@ def _match_rhel_version(cpe): def cpe_to_platform(cpe): - trivials = ["fedora", "sles", "ubuntu", "debian"] + trivials = ["fedora", "opensuse", "sles", "ubuntu", "debian"] for platform in trivials: if platform in cpe: return platform From 54d6271846aa0b81f25464622b125c68d0f0ea4a Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Mon, 14 Sep 2026 14:07:38 +0300 Subject: [PATCH 8/9] Add gnome related rules support for opensuse --- .../ansible/shared.yml | 6 ++- .../dconf_gnome_banner_enabled/bash/shared.sh | 3 ++ .../tests/missing_profile.fail.sh | 2 +- .../ansible/shared.yml | 6 ++- .../bash/shared.sh | 3 ++ .../tests/db_not_up_to_date.fail.sh | 5 ++- .../tests/no_db_files.fail.sh | 2 + .../ansible/shared.yml | 2 +- .../enable_dconf_user_profile/bash/shared.sh | 2 +- .../enable_dconf_user_profile/oval/shared.xml | 2 +- .../tests/commented.fail.sh | 5 ++- .../tests/correct.pass.sh | 5 ++- .../tests/correct_messy.pass.sh | 13 ++++--- .../tests/missing.fail.sh | 5 ++- .../tests/wrong.fail.sh | 6 ++- .../ansible/shared.yml | 6 ++- .../bash/shared.sh | 4 +- .../tests/correct_value.pass.sh | 1 + .../tests/correct_value_wrong_db.fail.sh | 1 + .../tests/wrong_value.fail.sh | 1 + .../ansible/shared.yml | 4 +- .../bash/shared.sh | 2 +- .../tests/missing_profiles.fail.sh | 2 +- .../rule.yml | 4 ++ .../tests/wrong_value.fail.sh | 5 +++ .../ansible/shared.yml | 2 +- .../ansible/shared.yml | 8 ++-- .../bash/shared.sh | 2 +- .../oval/shared.xml | 4 +- .../tests/correct_value.pass.sh | 2 +- .../tests/missing_profiles.fail.sh | 4 +- .../ansible/shared.yml | 8 ++-- .../bash/shared.sh | 2 +- .../oval/shared.xml | 4 +- .../tests/correct_value.pass.sh | 2 +- .../tests/missing_profiles.fail.sh | 4 +- .../ansible/shared.yml | 12 +++--- .../bash/shared.sh | 4 +- .../oval/shared.xml | 10 ++--- .../tests/comment.fail.sh | 4 +- .../tests/correct_value.pass.sh | 4 +- .../tests/correct_value_not_locked.fail.sh | 6 ++- .../tests/correct_value_wrong_db.fail.sh | 2 +- .../tests/missing_profiles.fail.sh | 7 +++- .../tests/setting_not_there.fail.sh | 2 + .../tests/wrong_value.fail.sh | 4 +- .../tests/zero_value.fail.sh | 4 +- .../ansible/shared.yml | 10 ++--- .../bash/shared.sh | 2 +- .../oval/shared.xml | 10 ++--- .../tests/comment.fail.sh | 4 +- .../tests/correct_value.pass.sh | 4 +- .../tests/correct_value_not_locked.fail.sh | 6 ++- .../tests/correct_value_wrong_db.fail.sh | 2 +- .../tests/missing_profiles.fail.sh | 4 +- .../tests/setting_not_there.fail.sh | 2 +- .../tests/wrong_value.fail.sh | 4 +- .../ansible/shared.yml | 38 ++++++++----------- .../bash/shared.sh | 2 +- .../oval/shared.xml | 4 +- .../tests/comment.fail.sh | 2 +- .../tests/correct_value.pass.sh | 2 +- .../tests/correct_value_unlocked.fail.sh | 2 +- .../tests/correct_value_wrong_db.fail.sh | 2 +- .../tests/missing_profiles.fail.sh | 7 +++- .../tests/wrong_value.fail.sh | 2 +- .../ansible/shared.yml | 10 ++++- .../bash/shared.sh | 6 ++- .../oval/shared.xml | 4 ++ .../tests/correct_value.pass.sh | 5 +++ .../tests/correct_value_wrong_db.fail.sh | 1 + .../tests/wrong_value.fail.sh | 1 + .../ansible/shared.yml | 8 ++-- .../bash/shared.sh | 2 +- .../oval/shared.xml | 4 +- .../tests/comment.fail.sh | 2 +- .../tests/correct_value.pass.sh | 2 +- .../tests/correct_value_not_locked.fail.sh | 2 +- .../tests/wrong_value.fail.sh | 2 +- .../ansible/shared.yml | 6 +-- .../bash/shared.sh | 2 +- .../oval/shared.xml | 2 +- .../tests/correct_value.pass.sh | 2 +- .../ansible/shared.yml | 6 +-- .../bash/shared.sh | 2 +- .../oval/shared.xml | 2 +- .../tests/comented_value.fail.sh | 2 +- .../tests/correct_value.pass.sh | 2 +- .../ansible/shared.yml | 14 ++++++- .../bash/shared.sh | 6 +++ .../oval/shared.xml | 8 ++++ .../tests/comment.fail.sh | 7 +++- .../tests/correct_value.pass.sh | 5 +++ .../tests/correct_value_unlocked.fail.sh | 6 ++- .../tests/correct_value_wrong_db.fail.sh | 2 +- .../tests/setting_not_there.fail.sh | 2 +- .../tests/wrong_value.fail.sh | 7 +++- 97 files changed, 285 insertions(+), 154 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml index 69998b424eeb..ea4ef21f1d8f 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_sle,multi_platform_almalinux # reboot = false # strategy = unknown # complexity = low @@ -26,3 +26,7 @@ - name: Dconf Update ansible.builtin.command: dconf update when: result_ini is changed or result_lineinfile is changed + +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh index ed6c7422e022..34887a337625 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh @@ -8,5 +8,8 @@ {{{ set_config_file("/etc/gdm3/greeter.dconf-defaults", "banner-message-enable", value="true", create='no', insert_after="\[org/gnome/login-screen\]", insert_before="", separator="=", separator_regex="", prefix_regex="^\s*", rule_id=rule_id) }}} {{% endif %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{% endif %}} {{{ bash_dconf_settings("org/gnome/login-screen", "banner-message-enable", "true", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} {{{ bash_dconf_lock("org/gnome/login-screen", "banner-message-enable", dconf_gdm_dir, "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/tests/missing_profile.fail.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/tests/missing_profile.fail.sh index 91f4915e8b19..5fc970a12991 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/tests/missing_profile.fail.sh +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/tests/missing_profile.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_ubuntu # packages = dconf,gdm source $SHARED/dconf_test_functions.sh diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml index e45918de8ba9..6498bbb18540 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -51,3 +51,7 @@ - name: Dconf Update ansible.builtin.command: dconf update when: result_ini is changed or result_lineinfile is changed + +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh index c686cbe1dbf3..2c5fde7317dd 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh @@ -1,5 +1,8 @@ # platform = multi_platform_all +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{% endif %}} dconf_login_banner_contents=$(echo "(bash-populate dconf_login_banner_contents)" ) {{{ bash_dconf_settings("org/gnome/login-screen", "banner-message-text", "'${dconf_login_banner_contents}'", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} {{{ bash_dconf_lock("org/gnome/login-screen", "banner-message-text", dconf_gdm_dir, "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/db_not_up_to_date.fail.sh b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/db_not_up_to_date.fail.sh index 2cbd013ea7bb..34f755d0f1e9 100644 --- a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/db_not_up_to_date.fail.sh +++ b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/db_not_up_to_date.fail.sh @@ -14,9 +14,10 @@ clean_dconf_settings add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "{{{ dconf_db }}}" "00-security-settings" add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "{{{ dconf_db }}}" "00-security-settings-lock" +{{% if 'suse' not in families %}} add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "local.d" "00-security-settings" add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "local.d" "00-security-settings-lock" - +{{% endif %}} dconf update # ensure that the modification happens a reasonable amount of time after running dconf update @@ -24,4 +25,6 @@ sleep 5 # make static keyfiles newer than the database add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "{{{ dconf_db }}}" "00-security-settings" +{{% if 'suse' not in families %}} add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/no_db_files.fail.sh b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/no_db_files.fail.sh index 7fa912bf8fdc..93433e51797e 100644 --- a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/no_db_files.fail.sh +++ b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/no_db_files.fail.sh @@ -19,5 +19,7 @@ sleep 5 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "{{{ dconf_db }}}" "00-security-settings" add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "{{{ dconf_db }}}" "00-security-settings-lock" +{{% if 'suse' not in families %}} add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "local.d" "00-security-settings" add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "local.d" "00-security-settings-lock" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/ansible/shared.yml b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/ansible/shared.yml index df0e3739cdc3..4b73c5069967 100644 --- a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_sle +# platform = multi_platform_opensuse,multi_platform_sle # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/bash/shared.sh b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/bash/shared.sh index a0f5289b7df6..0ebce60301ab 100644 --- a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/bash/shared.sh @@ -1,3 +1,3 @@ -# platform = multi_platform_sle +# platform = multi_platform_opensuse,multi_platform_sle {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} diff --git a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/oval/shared.xml b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/oval/shared.xml index c8b324ce368a..b19b11183157 100644 --- a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/oval/shared.xml @@ -13,7 +13,7 @@ - {{% if 'sle' in product %}} + {{% if 'suse' in families %}} /etc/dconf/profile/gdm ^user-db:user\nsystem-db:gdm$ {{% else %}} diff --git a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/commented.fail.sh b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/commented.fail.sh index 0ef85ec4cbdc..c6272b836665 100644 --- a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/commented.fail.sh +++ b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/commented.fail.sh @@ -1,12 +1,15 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# packages = dconf +# platform = multi_platform_opensuse,multi_platform_ubuntu cat > /etc/dconf/profile/gdm < /etc/dconf/profile/user < /etc/dconf/profile/gdm < /etc/dconf/profile/user < /etc/dconf/profile/gdm < /etc/dconf/profile/user < /etc/dconf/profile/gdm < /etc/dconf/profile/user < -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -37,7 +37,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/correct_value.pass.sh index 1abf5d412314..671e227e7587 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/correct_value.pass.sh @@ -8,7 +8,7 @@ install_dconf_and_gdm_if_needed clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/missing_profiles.fail.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/missing_profiles.fail.sh index 73b45031cd11..b081246c183f 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/missing_profiles.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/tests/missing_profiles.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_sle,multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_sle,multi_platform_ubuntu # packages = gdm,dconf # profiles = xccdf_org.ssgproject.content_profile_stig @@ -8,7 +8,7 @@ install_dconf_and_gdm_if_needed clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/media-handling" "automount-open" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/media-handling" "automount-open" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml index 146dd6dcc96b..ad51d662a88a 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -6,7 +6,7 @@ - name: "Disable GNOME3 Automounting - autorun-never" community.general.ini_file: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} dest: /etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings {{% else %}} dest: /etc/dconf/db/local.d/00-security-settings @@ -21,7 +21,7 @@ - name: "Prevent user modification of GNOME3 Automounting - autorun-never" ansible.builtin.lineinfile: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock {{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock @@ -35,6 +35,6 @@ ansible.builtin.command: dconf update when: result_ini is changed or result_lineinfile is changed -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh index 35ce8adc2d9a..c5bc0658e902 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh @@ -5,7 +5,7 @@ {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{{ bash_dconf_settings("org/gnome/desktop/media-handling", "autorun-never", "true", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} {{{ bash_dconf_lock("org/gnome/desktop/media-handling", "autorun-never", dconf_gdm_dir, "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/oval/shared.xml index e7f55bf5d43f..f4644d667f3b 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/oval/shared.xml @@ -20,7 +20,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -37,7 +37,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/correct_value.pass.sh index 35a93fead2eb..de8bd6c0032c 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/correct_value.pass.sh @@ -8,7 +8,7 @@ install_dconf_and_gdm_if_needed clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/media-handling" "autorun-never" "true" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/media-handling" "autorun-never" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/missing_profiles.fail.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/missing_profiles.fail.sh index a7991c7f5383..e8c7cb446f30 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/missing_profiles.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/tests/missing_profiles.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_sle,multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_sle,multi_platform_ubuntu # packages = gdm,dconf # profiles = xccdf_org.ssgproject.content_profile_stig @@ -8,7 +8,7 @@ install_dconf_and_gdm_if_needed clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/media-handling" "autorun-never" "true" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/media-handling" "autorun-never" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml index d026ed281430..b00b46c43429 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -8,7 +8,7 @@ - name: "Set GNOME3 Screensaver Inactivity Timeout" community.general.ini_file: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} dest: "/etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings" {{% else %}} dest: "/etc/dconf/db/local.d/00-security-settings" @@ -20,11 +20,11 @@ no_extra_spaces: yes register: result_ini -{{% if 'ubuntu' in product or product in ["sle15", "sle16"] %}} +{{% if 'ubuntu' in product or product in ["sle15", "sle16", 'opensuse16'] %}} - name: "Prevent user modification of GNOME Screensaver Inactivity Timeout" ansible.builtin.lineinfile: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock {{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock @@ -37,12 +37,12 @@ - name: Dconf Update ansible.builtin.command: dconf update -{{% if 'ubuntu' in product or product in ["sle15", "sle16"] %}} +{{% if 'ubuntu' in product or product in ['opensuse16', 'sle15', 'sle16'] %}} when: result_ini is changed or result_lineinfile is changed {{% else %}} when: result_ini is changed {{% endif %}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/bash/shared.sh index 48fbd7b92677..6a6a1873aeb2 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/bash/shared.sh @@ -6,14 +6,14 @@ {{{ bash_dconf_lock("org/gnome/desktop/session", "idle-delay", "local.d", "00-security-settings-lock") }}} {{% endif %}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{{ bash_dconf_lock("org/gnome/desktop/session", "idle-delay", dconf_gdm_dir, "00-security-settings-lock") }}} {{% endif %}} {{{ bash_instantiate_variables("inactivity_timeout_value") }}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_dconf_settings("org/gnome/desktop/session", "idle-delay", "uint32 ${inactivity_timeout_value}", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} {{% else %}} {{{ bash_dconf_settings("org/gnome/desktop/session", "idle-delay", "uint32 ${inactivity_timeout_value}", "local.d", "00-security-settings", rule_id=rule_id) }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/oval/shared.xml index 5108cdd21a2a..3ad31148b8ac 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/oval/shared.xml @@ -7,7 +7,7 @@ - {{% if 'ubuntu' in product or product in ["sle15", "sle16"] %}} + {{% if 'ubuntu' in product or product in ["opensuse16", "sle15", "sle16"] %}} {{% endif %}} @@ -21,7 +21,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -44,7 +44,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -68,7 +68,7 @@ -{{% if 'ubuntu' in product or product in ["sle15", "sle16"] %}} +{{% if 'ubuntu' in product or product in ['opensuse16', 'sle15', 'sle16'] %}} @@ -76,7 +76,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/comment.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/comment.fail.sh index 5e0c633763aa..60b088d75920 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/comment.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/comment.fail.sh @@ -5,7 +5,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/session" "#idle-delay" "uint32 900" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/session" "#idle-delay" "uint32 900" "local.d" "00-security-settings" @@ -13,6 +13,6 @@ add_dconf_setting "org/gnome/desktop/session" "#idle-delay" "uint32 900" "local. {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value.pass.sh index 6669faeae713..0e9333486291 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value.pass.sh @@ -7,7 +7,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d" "00-security-settings" @@ -15,6 +15,6 @@ add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_not_locked.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_not_locked.fail.sh index fc408293da50..aea38465291c 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_not_locked.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_not_locked.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_sle,multi_platform_ubuntu # packages = dconf,gdm # variables = inactivity_timeout_value=900 @@ -8,4 +8,8 @@ clean_dconf_settings add_dconf_profiles +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_wrong_db.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_wrong_db.fail.sh index 6f01caf81842..071c00052728 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_wrong_db.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/correct_value_wrong_db.fail.sh @@ -11,6 +11,6 @@ add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "dummy.d {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" -{{% elif product in ["sle15", "sle16"] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/missing_profiles.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/missing_profiles.fail.sh index f1e1a535713d..809d5718e405 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/missing_profiles.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/missing_profiles.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_sle,multi_platform_ubuntu # packages = dconf,gdm # variables = inactivity_timeout_value=900 @@ -7,5 +7,10 @@ clean_dconf_settings +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "{{{ dconf_gdm_dir }}}" "00-security-settings" +add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 900" "local.d" "00-security-settings" add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/setting_not_there.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/setting_not_there.fail.sh index 07b5a1ed52f0..abca9e4423ba 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/setting_not_there.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/setting_not_there.fail.sh @@ -8,4 +8,6 @@ add_dconf_profiles {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/wrong_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/wrong_value.fail.sh index 9ba07b3d3fa0..29f3b9a0c5d2 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/wrong_value.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 2900" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 2900" "local.d" "00-security-settings" @@ -14,6 +14,6 @@ add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 2900" "local. {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" -{{% elif product in ["sle15", "sle16"] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/zero_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/zero_value.fail.sh index f1f163681170..f8b02a41af7f 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/zero_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/tests/zero_value.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ["sle15", "sle16"] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 0" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 0" "local.d" "00-security-settings" @@ -14,6 +14,6 @@ add_dconf_setting "org/gnome/desktop/session" "idle-delay" "uint32 0" "local.d" {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings" -{{% elif product in ["sle15", "sle16"] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml index bba429923a1a..71ff6038ad4b 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -8,7 +8,7 @@ - name: "Set GNOME3 Screensaver Lock Delay After Activation Period" community.general.ini_file: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} dest: "/etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings" {{% else %}} dest: "/etc/dconf/db/local.d/00-security-settings" @@ -20,7 +20,7 @@ no_extra_spaces: yes register: result_ini -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} - name: "Prevent user modification of GNOME Screensaver Lock Delay" ansible.builtin.lineinfile: path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock @@ -33,12 +33,12 @@ - name: Dconf Update ansible.builtin.command: dconf update -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} when: result_ini is changed or result_lineinfile is changed {{% else %}} when: result_ini is changed {{% endif %}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/bash/shared.sh index ea2d8951f0c3..a609c97080dd 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/bash/shared.sh @@ -8,7 +8,7 @@ {{{ bash_instantiate_variables("var_screensaver_lock_delay") }}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-delay", dconf_gdm_dir, "00-security-settings-lock") }}} {{{ bash_dconf_settings("org/gnome/desktop/screensaver", "lock-delay", "uint32 ${var_screensaver_lock_delay}", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/oval/shared.xml index 2262be9e45d7..298b55dc30c9 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/oval/shared.xml @@ -8,7 +8,7 @@ - {{% if 'ubuntu' in product or product in ["sle15", "sle16"] %}} + {{% if 'ubuntu' in product or product in ["sle15", "sle16", "opensuse16"] %}} {{% endif %}} @@ -22,7 +22,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -43,7 +43,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -63,14 +63,14 @@ -{{% if 'ubuntu' in product or product in ["sle15", "sle16"] %}} +{{% if 'ubuntu' in product or product in ["sle15", "sle16", "opensuse16"] %}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/comment.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/comment.fail.sh index 91506eef020e..f708906e2dd8 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/comment.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/comment.fail.sh @@ -5,7 +5,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "#lock-delay" "uint32 5" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "#lock-delay" "uint32 5" "local.d" "00-security-settings" @@ -13,6 +13,6 @@ add_dconf_setting "org/gnome/desktop/screensaver" "#lock-delay" "uint32 5" "loca {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value.pass.sh index 0d2d78c07a5c..f7bbaf5e45a8 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value.pass.sh @@ -7,7 +7,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "local.d" "00-security-settings" @@ -15,6 +15,6 @@ add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "local {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_not_locked.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_not_locked.fail.sh index be2162d7a955..58521eb568d8 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_not_locked.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_not_locked.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_sle,multi_platform_ubuntu # packages = dconf,gdm # variables = var_screensaver_lock_delay=5 @@ -8,4 +8,8 @@ clean_dconf_settings add_dconf_profiles +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_wrong_db.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_wrong_db.fail.sh index 28a2f1b08eaf..dbc99429f475 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_wrong_db.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/correct_value_wrong_db.fail.sh @@ -10,6 +10,6 @@ add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "dummy {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/missing_profiles.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/missing_profiles.fail.sh index b1e396ef0fcc..23c4ee325a2d 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/missing_profiles.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/missing_profiles.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_sle,multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_sle,multi_platform_ubuntu # packages = dconf,gdm # variables = var_screensaver_lock_delay=5 @@ -7,7 +7,7 @@ clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 5" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/setting_not_there.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/setting_not_there.fail.sh index 82d7c77d7d7a..1c22fe82eb18 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/setting_not_there.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/setting_not_there.fail.sh @@ -8,6 +8,6 @@ clean_dconf_settings {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/wrong_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/wrong_value.fail.sh index bc5deb4f7640..9bb710f41013 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/tests/wrong_value.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 100" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 100" "local.d" "00-security-settings" @@ -14,6 +14,6 @@ add_dconf_setting "org/gnome/desktop/screensaver" "lock-delay" "uint32 100" "loc {{% if 'ubuntu' in product %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings" -{{% elif product in ['sle15', 'sle16'] %}} +{{% elif product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml index 50bc0350c3bc..656f866748fe 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml @@ -1,9 +1,10 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low # disruption = medium +{{% if 'suse' not in families %}} - name: "{{{ rule_title }}} - Enable GNOME3 Screensaver Lock After Idle Period" community.general.ini_file: dest: "/etc/dconf/db/local.d/00-security-settings" @@ -13,7 +14,6 @@ create: yes no_extra_spaces: yes mode: 0644 - when: ansible_distribution != 'SLES' register: screensaver_config - name: "{{{ rule_title }}} - Prevent user modification of GNOME lock-enabled" @@ -23,8 +23,13 @@ line: '/org/gnome/desktop/screensaver/lock-enabled' create: yes mode: 0644 - when: ansible_distribution != 'SLES' register: screensaver_lock +- name: "{{{ rule_title }}} - Update dconf database for non-SLES systems" + ansible.builtin.command: dconf update + when: + - (screensaver_config is changed or screensaver_lock is changed) +{{% else %}} +{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} - name: "{{{ rule_title }}} - Enable GNOME3 Screensaver Lock After Idle Period" community.general.ini_file: @@ -35,7 +40,6 @@ create: yes no_extra_spaces: yes mode: 0644 - when: ansible_distribution == 'SLES' register: lockdown_config - name: "{{{ rule_title }}} - Prevent user modification of GNOME disable-lock-screen" @@ -45,33 +49,21 @@ line: '/org/gnome/desktop/lockdown/disable-lock-screen' create: yes mode: 0644 - when: ansible_distribution == 'SLES' register: lockdown_lock +- name: "{{{ rule_title }}} - Update dconf database for SLES systems" + ansible.builtin.command: dconf update + when: + - (lockdown_config is changed or lockdown_lock is changed) + +{{% endif %}} + - name: "{{{ rule_title }}} - Check GNOME3 screenserver disable-lock-screen false" ansible.builtin.command: gsettings get org.gnome.desktop.lockdown disable-lock-screen register: cmd_out - when: ansible_distribution == 'SLES' changed_when: false - name: "{{{ rule_title }}} - Update GNOME3 screenserver disable-lock-screen false" ansible.builtin.command: gsettings set org.gnome.desktop.lockdown disable-lock-screen false when: - - ansible_distribution == 'SLES' - cmd_out.stdout != 'false' - -- name: "{{{ rule_title }}} - Update dconf database for non-SLES systems" - ansible.builtin.command: dconf update - when: - - ansible_distribution != 'SLES' - - (screensaver_config is changed or screensaver_lock is changed) - -- name: "{{{ rule_title }}} - Update dconf database for SLES systems" - ansible.builtin.command: dconf update - when: - - ansible_distribution == 'SLES' - - (lockdown_config is changed or lockdown_lock is changed) - -{{% if product in ['sle15', 'sle16'] %}} -{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} -{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/bash/shared.sh index b1cbfc4a048f..2c8e379c3766 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/bash/shared.sh @@ -5,7 +5,7 @@ {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} -{{% if 'sle' in product %}} +{{% if 'suse' in families %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} gsettings set org.gnome.desktop.lockdown disable-lock-screen false {{{ bash_dconf_settings("org/gnome/desktop/lockdown", "disable-lock-screen", "false", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/oval/shared.xml index a577396eea33..10c2f1124b11 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/oval/shared.xml @@ -18,7 +18,7 @@ -{{% if product in ['sle12', 'sle15', 'sle16'] %}} +{{% if 'suse' in families %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ ^.*$ ^\[org/gnome/desktop/lockdown\]([^\n]*\n+)+?disable-lock-screen=false$ @@ -37,7 +37,7 @@ -{{% if product in ['sle12', 'sle15', 'sle16'] %}} +{{% if 'suse' in families %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ ^.*$ ^/org/gnome/desktop/lockdown/disable-lock-screen$ diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/comment.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/comment.fail.sh index 71bf01f44d5a..9318092e1ff0 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/comment.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/comment.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if 'sle' in product %}} +{{% if 'suse' in families %}} add_dconf_setting "org/gnome/desktop/lockdown" "#disable-lock-screen" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/lockdown" "disable-lock-screen" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value.pass.sh index 4dfbde66f382..54d76175b65a 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value.pass.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if 'sle' in product %}} +{{% if 'suse' in families %}} add_dconf_setting "org/gnome/desktop/lockdown" "disable-lock-screen" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/lockdown" "disable-lock-screen" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_unlocked.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_unlocked.fail.sh index c0993a206d03..a58a65435759 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_unlocked.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_unlocked.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if 'sle' in product %}} +{{% if 'suse' in families %}} add_dconf_setting "org/gnome/desktop/lockdown" "disable-lock-screen" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-enabled" "true" "local.d" "00-security-settings" diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_wrong_db.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_wrong_db.fail.sh index af49dcf086ef..b5f29f41b3a3 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_wrong_db.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/correct_value_wrong_db.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if 'sle' in product %}} +{{% if 'suse' in families %}} add_dconf_setting "org/gnome/desktop/lockdown" "disable-lock-screen" "false" "dummy.d" "00-security-settings" add_dconf_lock "org/gnome/desktop/lockdown" "disable-lock-screen" "dummy.d" "00-security-settings-lock" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/missing_profiles.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/missing_profiles.fail.sh index 1584707f6319..1132596d35ab 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/missing_profiles.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/missing_profiles.fail.sh @@ -1,10 +1,15 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# platform = multi_platform_opensuse,multi_platform_ubuntu # packages = dconf,gdm . $SHARED/dconf_test_functions.sh clean_dconf_settings +{{% if 'suse' in families %}} +add_dconf_setting "org/gnome/desktop/screensaver" "lock-enabled" "true" "{{{ dconf_gdm_dir }}}" "00-security-settings" +add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "lock-enabled" "true" "local.d" "00-security-settings" add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/wrong_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/wrong_value.fail.sh index a27061680661..895f038c4090 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/tests/wrong_value.fail.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if 'sle' in product %}} +{{% if 'suse' in families %}} add_dconf_setting "org/gnome/desktop/lockdown" "disable-lock-screen" "true" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/lockdown" "disable-lock-screen" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml index 5ceafd798da0..1a67fe45b91a 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml @@ -1,17 +1,25 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel # reboot = false # strategy = unknown # complexity = low # disruption = medium - name: "Prevent user modification of GNOME Screensaver lock-enabled" ansible.builtin.lineinfile: + {{% if product in ['opensuse16', 'sle15', 'sle16'] %}} + path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock + {{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock + {{% endif %}} regexp: '^/org/gnome/desktop/screensaver/lock-enabled$' line: '/org/gnome/desktop/screensaver/lock-enabled' create: yes mode: 0644 register: result_lineinfile +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{% endif %}} + - name: Dconf Update ansible.builtin.command: dconf update when: result_lineinfile is changed diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/bash/shared.sh index 096e7095dc25..6ac289bd0d15 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/bash/shared.sh @@ -1,4 +1,8 @@ # platform = multi_platform_all - +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-enabled", dconf_gdm_dir, "00-security-settings-lock") }}} +{{% else %}} {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-enabled", "local.d", "00-security-settings-lock") }}} +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/oval/shared.xml index 55edd6753a33..7e0a774b9f28 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/oval/shared.xml @@ -17,7 +17,11 @@ +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} + /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ +{{% else %}} /etc/dconf/db/local.d/locks/ +{{% endif %}} ^.*$ ^/org/gnome/desktop/screensaver/lock-enabled$ 1 diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value.pass.sh index 908f62743dd7..0c6d57f83c19 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value.pass.sh @@ -4,4 +4,9 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings +add_dconf_profiles +{{% if 'suse' in families %}} +add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value_wrong_db.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value_wrong_db.fail.sh index bcabe0596bcc..b606acd09945 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value_wrong_db.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/correct_value_wrong_db.fail.sh @@ -4,4 +4,5 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings +add_dconf_profiles add_dconf_lock "org/gnome/desktop/screensaver" "lock-enabled" "dummy.d" "00-security-settings" diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/wrong_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/wrong_value.fail.sh index 55a13453790f..87bce1fac58e 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/tests/wrong_value.fail.sh @@ -4,3 +4,4 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings +add_dconf_profiles diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml index af18425ff39c..f54d83c1d9bc 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -6,7 +6,7 @@ - name: "Implement Blank Screensaver" community.general.ini_file: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} dest: "/etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings" {{% else %}} dest: "/etc/dconf/db/local.d/00-security-settings" @@ -21,7 +21,7 @@ - name: "Prevent user modification of GNOME picture-uri" ansible.builtin.lineinfile: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock {{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock @@ -35,6 +35,6 @@ ansible.builtin.command: dconf update when: result_ini is changed or result_lineinfile is changed -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh index fac9956514c9..e9800532ddd9 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh @@ -5,7 +5,7 @@ {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{{ bash_dconf_settings("org/gnome/desktop/screensaver", "picture-uri", "string ''", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "picture-uri", dconf_gdm_dir, "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/oval/shared.xml index fcbf59314639..ac86c9e09cf9 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/oval/shared.xml @@ -18,7 +18,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/ {{% else %}} /etc/dconf/db/local.d/ @@ -38,7 +38,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/comment.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/comment.fail.sh index 030d50ccc39f..8f9aa11c6408 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/comment.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/comment.fail.sh @@ -4,7 +4,7 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "#picture-uri" "string ''" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/screensaver" "picture-uri" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value.pass.sh index 22dd8ce9c146..e7bfc1bc8442 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value.pass.sh @@ -6,7 +6,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "picture-uri" "string ''" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/screensaver" "picture-uri" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value_not_locked.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value_not_locked.fail.sh index ca26333951c2..af2f4da4c404 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value_not_locked.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/correct_value_not_locked.fail.sh @@ -5,7 +5,7 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "picture-uri" "string ''" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_setting "org/gnome/desktop/screensaver" "picture-uri" "string ''" "local.d" "00-security-settings" diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/wrong_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/wrong_value.fail.sh index f611107f57eb..820ffcf159ee 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/tests/wrong_value.fail.sh @@ -5,7 +5,7 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_setting "org/gnome/desktop/screensaver" "picture-uri" "string 'somestring'" "{{{ dconf_gdm_dir }}}" "00-security-settings" add_dconf_lock "org/gnome/desktop/screensaver" "picture-uri" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml index f0b64643f1b2..ab74bc3af10b 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -6,7 +6,7 @@ - name: "Prevent user modification of GNOME lock-delay" ansible.builtin.lineinfile: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock {{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock @@ -20,6 +20,6 @@ ansible.builtin.command: dconf update when: result_lineinfile is changed -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/bash/shared.sh index b03ed1890806..f086e8798020 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/bash/shared.sh @@ -1,6 +1,6 @@ # platform = multi_platform_all -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-delay", dconf_gdm_dir, "00-security-settings-lock") }}} {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/oval/shared.xml index f699b71bf5e2..45ebfdb20114 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/oval/shared.xml @@ -17,7 +17,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/tests/correct_value.pass.sh index 9f38debb5fb8..8b6f93366bbb 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/tests/correct_value.pass.sh @@ -5,7 +5,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings" {{% else %}} add_dconf_lock "org/gnome/desktop/screensaver" "lock-delay" "local.d" "00-security-settings" diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml index 74c527381723..0563f70ca652 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -7,7 +7,7 @@ - name: "Prevent user modification of GNOME Session idle-delay" ansible.builtin.lineinfile: mode: 0644 -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock {{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock @@ -21,6 +21,6 @@ ansible.builtin.command: dconf update when: result_lineinfile is changed -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/bash/shared.sh index 054532bc47b7..22867abf264d 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/bash/shared.sh @@ -1,6 +1,6 @@ # platform = multi_platform_all -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} {{{ bash_dconf_lock("org/gnome/desktop/session", "idle-delay", dconf_gdm_dir, "00-security-settings-lock") }}} {{% else %}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/oval/shared.xml index 3cd1195f1fde..d2979c82bac3 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/oval/shared.xml @@ -17,7 +17,7 @@ -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ {{% else %}} /etc/dconf/db/local.d/locks/ diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/comented_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/comented_value.fail.sh index 8b3c7fb27796..5e37e84cbad9 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/comented_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/comented_value.fail.sh @@ -4,7 +4,7 @@ . $SHARED/dconf_test_functions.sh clean_dconf_settings -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "# org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock" {{% else %}} add_dconf_lock "# org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings-lock" diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/correct_value.pass.sh index 1ea2fe380812..b8e8fcc2dda6 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/tests/correct_value.pass.sh @@ -5,7 +5,7 @@ clean_dconf_settings add_dconf_profiles -{{% if product in ['sle15', 'sle16'] %}} +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock" {{% else %}} add_dconf_lock "org/gnome/desktop/session" "idle-delay" "local.d" "00-security-settings-lock" diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml index c6a1a82df328..aeaffa9e34c4 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml @@ -1,11 +1,15 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel # reboot = false # strategy = unknown # complexity = low # disruption = medium - name: "Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3" community.general.ini_file: +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} + dest: /etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings +{{% else %}} dest: /etc/dconf/db/local.d/00-security-settings +{{% endif %}} section: org/gnome/settings-daemon/plugins/media-keys option: logout value: "['']" @@ -16,7 +20,11 @@ - name: "Prevent user modification of GNOME disablement of Ctrl-Alt-Del" ansible.builtin.lineinfile: +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} + path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock +{{% else %}} path: /etc/dconf/db/local.d/locks/00-security-settings-lock +{{% endif %}} regexp: '^/org/gnome/settings-daemon/plugins/media-keys/logout$' line: '/org/gnome/settings-daemon/plugins/media-keys/logout' create: yes @@ -26,3 +34,7 @@ - name: Dconf Update ansible.builtin.command: dconf update when: result_ini is changed or result_lineinfile is changed + +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh index 9e802c6832f7..dd7939dfdd5c 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh @@ -1,5 +1,10 @@ # platform = multi_platform_all +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} +{{{ bash_dconf_settings("org/gnome/settings-daemon/plugins/media-keys", "logout", "['']", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}} +{{{ bash_dconf_lock("org/gnome/settings-daemon/plugins/media-keys", "logout", dconf_gdm_dir, "00-security-settings-lock") }}} +{{% else %}} {{% if 'ubuntu' in product %}} {{{ bash_enable_dconf_user_profile(profile="user", database="local") }}} {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}} @@ -11,3 +16,4 @@ {{{ bash_dconf_settings("org/gnome/settings-daemon/plugins/media-keys", "logout", "['']", "local.d", "00-security-settings", rule_id=rule_id) }}} {{%- endif %}} {{{ bash_dconf_lock("org/gnome/settings-daemon/plugins/media-keys", "logout", "local.d", "00-security-settings-lock") }}} +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/oval/shared.xml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/oval/shared.xml index 1094167b5fd0..a33012499a9a 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/oval/shared.xml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/oval/shared.xml @@ -18,7 +18,11 @@ +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} + /etc/dconf/db/{{{ dconf_gdm_dir }}}/ +{{% else %}} /etc/dconf/db/local.d/ +{{% endif %}} ^.*$ ^\[org/gnome/settings-daemon/plugins/media-keys\]([^\n]*\n+)+?logout[\s]*=[\s]*(\[''\]|@as[\s]*\[\])$ 1 @@ -31,7 +35,11 @@ +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} + /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/ +{{% else %}} /etc/dconf/db/local.d/locks/ +{{% endif %}} ^.*$ ^/org/gnome/settings-daemon/plugins/media-keys/logout$ 1 diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/comment.fail.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/comment.fail.sh index 20a239467126..bed9ee838fda 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/comment.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/comment.fail.sh @@ -1,10 +1,15 @@ #!/bin/bash - +# packages = dconf,gdm . $SHARED/dconf_test_functions.sh install_dconf_and_gdm_if_needed clean_dconf_settings add_dconf_profiles +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "#logout" "['']" "{{{ dconf_gdm_dir }}}" "00-security-settings" +add_dconf_lock "org/gnome/settings-daemon/plugins/media-keys" "logout" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "#logout" "['']" "local.d" "00-security-settings" add_dconf_lock "org/gnome/settings-daemon/plugins/media-keys" "logout" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value.pass.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value.pass.sh index bfe8cdf57a28..31d13055b907 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value.pass.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value.pass.sh @@ -7,7 +7,12 @@ install_dconf_and_gdm_if_needed clean_dconf_settings add_dconf_profiles +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "logout" "['']" "{{{ dconf_gdm_dir }}}" "00-security-settings" +add_dconf_lock "org/gnome/settings-daemon/plugins/media-keys" "logout" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "logout" "['']" "local.d" "00-security-settings" add_dconf_lock "org/gnome/settings-daemon/plugins/media-keys" "logout" "local.d" "00-security-settings" +{{% endif %}} dconf update diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_unlocked.fail.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_unlocked.fail.sh index 11819cb9bb31..0af086ff80c2 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_unlocked.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_unlocked.fail.sh @@ -1,9 +1,13 @@ #!/bin/bash - +# packages = dconf,gdm . $SHARED/dconf_test_functions.sh install_dconf_and_gdm_if_needed clean_dconf_settings add_dconf_profiles +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "logout" "['']" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "logout" "['']" "local.d" "00-security-settings" +{{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_wrong_db.fail.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_wrong_db.fail.sh index 5c7f7584bb03..f8f15075ce1f 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_wrong_db.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/correct_value_wrong_db.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash - +# packages = dconf,gdm . $SHARED/dconf_test_functions.sh install_dconf_and_gdm_if_needed diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/setting_not_there.fail.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/setting_not_there.fail.sh index c513b48063b5..2dda594b274b 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/setting_not_there.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/setting_not_there.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash - +# packages = dconf,gdm . $SHARED/dconf_test_functions.sh install_dconf_and_gdm_if_needed diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/wrong_value.fail.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/wrong_value.fail.sh index 37c044d01c4e..67b6003d4e06 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/tests/wrong_value.fail.sh @@ -1,10 +1,15 @@ #!/bin/bash - +# packages = dconf,gdm . $SHARED/dconf_test_functions.sh install_dconf_and_gdm_if_needed clean_dconf_settings add_dconf_profiles +{{% if product in ['opensuse16', 'sle15', 'sle16'] %}} +add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "logout" "'Something different'" "{{{ dconf_gdm_dir }}}" "00-security-settings" +add_dconf_lock "org/gnome/settings-daemon/plugins/media-keys" "logout" "{{{ dconf_gdm_dir }}}" "00-security-settings" +{{% else %}} add_dconf_setting "org/gnome/settings-daemon/plugins/media-keys" "logout" "'Something different'" "local.d" "00-security-settings" add_dconf_lock "org/gnome/settings-daemon/plugins/media-keys" "logout" "local.d" "00-security-settings" +{{% endif %}} From ef15f9db23c8c08818215a01f9fa0de05d2669a5 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Mon, 14 Sep 2026 14:09:22 +0300 Subject: [PATCH 9/9] Add rule enable_dconf_user_profile to opensuse leap 16 stig profile --- products/opensuse16/profiles/stig.profile | 1 + 1 file changed, 1 insertion(+) diff --git a/products/opensuse16/profiles/stig.profile b/products/opensuse16/profiles/stig.profile index ed3ccc8250a8..7096e0e539b9 100644 --- a/products/opensuse16/profiles/stig.profile +++ b/products/opensuse16/profiles/stig.profile @@ -10,6 +10,7 @@ description: |- selections: - srg_gpos:all - package_audit-audispd-plugins_installed + - enable_dconf_user_profile - '!aide_periodic_cron_checking' - '!aide_verify_ext_attributes' - '!enable_fips_mode'