Add gnome rules opensuse leap16

CMakeLists.txt

@@ -110,6 +110,7 @@ option(SSG_PRODUCT_OL10 "If enabled, the Oracle Linux 10 SCAP content will be bu
 option(SSG_PRODUCT_OPENEMBEDDED "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_OPENEULER2203 "If enabled, the openEuler 22.03 LTS content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_OPENSUSE "If enabled, the openSUSE SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+option(SSG_PRODUCT_OPENSUSE16 "If enabled, the openSUSE Leap 16 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_RHCOS4 "If enabled, the RHCOS4 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_RHEL8 "If enabled, the RHEL8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
 option(SSG_PRODUCT_RHEL9 "If enabled, the RHEL9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
@@ -349,6 +350,7 @@ message(STATUS "Oracle Linux 10: ${SSG_PRODUCT_OL10}")
 message(STATUS "OpenEmbedded: ${SSG_PRODUCT_OPENEMBEDDED}")
 message(STATUS "openEuler 22.03 LTS: ${SSG_PRODUCT_OPENEULER2203}")
 message(STATUS "openSUSE: ${SSG_PRODUCT_OPENSUSE}")
+message(STATUS "openSUSE Leap 16: ${SSG_PRODUCT_OPENSUSE16}")
 message(STATUS "RHEL 8: ${SSG_PRODUCT_RHEL8}")
 message(STATUS "RHEL 9: ${SSG_PRODUCT_RHEL9}")
 message(STATUS "RHEL 10: ${SSG_PRODUCT_RHEL10}")
@@ -464,6 +466,9 @@ endif()
 if(SSG_PRODUCT_OPENSUSE)
     add_subdirectory("products/opensuse" "opensuse")
 endif()
+if(SSG_PRODUCT_OPENSUSE16)
+    add_subdirectory("products/opensuse16" "opensuse16")
+endif()
 if(SSG_PRODUCT_RHEL8)
     add_subdirectory("products/rhel8" "rhel8")
 endif()

Dockerfiles/test_suite-opensuse16

@@ -0,0 +1,22 @@
+FROM registry.opensuse.org/opensuse/leap:16
+
+ENV AUTH_KEYS=/root/.ssh/authorized_keys
+
+ARG CLIENT_PUBLIC_KEY
+ARG ADDITIONAL_PACKAGES
+
+RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/16.0/repo/oss/ leap-oss
+RUN zypper refresh
+
+RUN true \
+        && zypper --non-interactive install openssh-clients openssh-server openscap-utils \
+        python313 python313-rpm python313-pip tar gawk ansible \
+        $ADDITIONAL_PACKAGES \
+&& true
+
+RUN true \
+        && for key_type in rsa ecdsa; do ssh-keygen -N '' -t $key_type -f /etc/ssh/ssh_host_${key_type}_key; done \
+        && mkdir -p /root/.ssh \
+        && printf "%s\n" "$CLIENT_PUBLIC_KEY" >> "$AUTH_KEYS" \
+        && chmod og-rw /root/.ssh "$AUTH_KEYS" \
+&& true

build_product

@@ -373,6 +373,7 @@ all_cmake_products=(
 	OPENEMBEDDED
 	OPENEULER2203
 	OPENSUSE
+	OPENSUSE16
 	RHCOS4
 	RHEL8
 	RHEL9

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml

@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_sle,multi_platform_almalinux
 # reboot = false
 # strategy = unknown
 # complexity = low
@@ -26,3 +26,7 @@
 - name: Dconf Update
   ansible.builtin.command: dconf update
   when: result_ini is changed or result_lineinfile is changed
+
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
+{{% endif %}}

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh

@@ -8,5 +8,8 @@
 {{{ set_config_file("/etc/gdm3/greeter.dconf-defaults", "banner-message-enable", value="true", create='no', insert_after="\[org/gnome/login-screen\]", insert_before="", separator="=", separator_regex="", prefix_regex="^\s*", rule_id=rule_id) }}}
 {{% endif %}}
 
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
+{{% endif %}}
 {{{ bash_dconf_settings("org/gnome/login-screen", "banner-message-enable", "true", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}}
 {{{ bash_dconf_lock("org/gnome/login-screen", "banner-message-enable", dconf_gdm_dir, "00-security-settings-lock") }}}

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/tests/missing_profile.fail.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 # packages = dconf,gdm
 
 source $SHARED/dconf_test_functions.sh

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml

@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle
 # reboot = false
 # strategy = unknown
 # complexity = low
@@ -51,3 +51,7 @@
 - name: Dconf Update
   ansible.builtin.command: dconf update
   when: result_ini is changed or result_lineinfile is changed
+
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
+{{% endif %}}

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh

@@ -1,5 +1,8 @@
 # platform = multi_platform_all
 
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
+{{% endif %}}
 dconf_login_banner_contents=$(echo "(bash-populate dconf_login_banner_contents)" )
 {{{ bash_dconf_settings("org/gnome/login-screen", "banner-message-text", "'${dconf_login_banner_contents}'", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}}
 {{{ bash_dconf_lock("org/gnome/login-screen", "banner-message-text", dconf_gdm_dir, "00-security-settings-lock") }}}

linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/db_not_up_to_date.fail.sh

@@ -14,14 +14,17 @@ clean_dconf_settings
 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "{{{ dconf_db }}}" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "{{{ dconf_db }}}" "00-security-settings-lock"
 
+{{% if 'suse' not in families %}}
 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "local.d" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "local.d" "00-security-settings-lock"
-
+{{% endif %}}
 dconf update
 
 # ensure that the modification happens a reasonable amount of time after running dconf update
 sleep 5
 
 # make static keyfiles newer than the database
 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "{{{ dconf_db }}}" "00-security-settings"
+{{% if 'suse' not in families %}}
 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "local.d" "00-security-settings"
+{{% endif %}}

linux_os/guide/system/software/gnome/dconf_db_up_to_date/tests/no_db_files.fail.sh

@@ -19,5 +19,7 @@ sleep 5
 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "{{{ dconf_db }}}" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "{{{ dconf_db }}}" "00-security-settings-lock"
 
+{{% if 'suse' not in families %}}
 add_dconf_setting "org/gnome/login-screen" "banner-message-enabled" "true" "local.d" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "banner-message-enable" "local.d" "00-security-settings-lock"
+{{% endif %}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/ansible/shared.yml

@@ -1,4 +1,4 @@
-# platform = multi_platform_sle
+# platform = multi_platform_opensuse,multi_platform_sle
 # reboot = false
 # strategy = unknown
 # complexity = low

linux_os/guide/system/software/gnome/enable_dconf_user_profile/bash/shared.sh

@@ -1,3 +1,3 @@
-# platform = multi_platform_sle
+# platform = multi_platform_opensuse,multi_platform_sle
 
 {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/oval/shared.xml

@@ -13,7 +13,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_dconf_user_profile"
   version="2">
-    {{% if 'sle' in product %}}
+    {{% if 'suse' in families %}}
       <ind:filepath>/etc/dconf/profile/gdm</ind:filepath>
       <ind:pattern operation="pattern match">^user-db:user\nsystem-db:gdm$</ind:pattern>
     {{% else %}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/commented.fail.sh

@@ -1,12 +1,15 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# packages = dconf
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 
 cat > /etc/dconf/profile/gdm <<EOF
 #user-db:user
 system-db:gdm
 EOF
 
+{{% if product not in ['opensuse16', 'sle15', 'sle16'] %}}
 cat > /etc/dconf/profile/user <<EOF
 user-db:user
 #system-db:local
 EOF
+{{% endif %}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/correct.pass.sh

@@ -1,12 +1,15 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# packages = dconf
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 
 cat > /etc/dconf/profile/gdm <<EOF
 user-db:user
 system-db:gdm
 EOF
 
+{{% if product not in ['opensuse16', 'sle15', 'sle16'] %}}
 cat > /etc/dconf/profile/user <<EOF
 user-db:user
 system-db:local
 EOF
+{{% endif %}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/correct_messy.pass.sh

@@ -1,17 +1,19 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# packages = dconf
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 
 cat > /etc/dconf/profile/gdm <<EOF
-# this 
-  user-db:user  
+# this
+  user-db:user
 # is
 # really
 # messy
-# system-db:gdm  
-  system-db:gdm  
+# system-db:gdm
+  system-db:gdm
 # stuff
 EOF
 
+{{% if product not in ['opensuse16', 'sle15', 'sle16'] %}}
 cat > /etc/dconf/profile/user <<EOF
 
 user-db:user
@@ -20,3 +22,4 @@ system-db:distro
 system-db:local
 
 EOF
+{{% endif %}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/missing.fail.sh

@@ -1,5 +1,8 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# packages = dconf
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 
 rm -f /etc/dconf/profile/gdm
+{{% if product not in ['opensuse16', 'sle15', 'sle16'] %}}
 rm -f /etc/dconf/profile/user
+{{% endif %}}

linux_os/guide/system/software/gnome/enable_dconf_user_profile/tests/wrong.fail.sh

@@ -1,12 +1,14 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# packages = dconf
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 
 cat > /etc/dconf/profile/gdm <<EOF
 user-db:user
 system-db:local
 EOF
-
+{{% if product not in ['opensuse16', 'sle15', 'sle16'] %}}
 cat > /etc/dconf/profile/user <<EOF
 user-db:user
 system-db:gdm
 EOF
+{{% endif %}}

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/ansible/shared.yml

@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel
 # reboot = false
 # strategy = unknown
 # complexity = low
@@ -26,3 +26,7 @@
 - name: Dconf Update
   ansible.builtin.command: dconf update
   when: result_ini is changed or result_lineinfile is changed
+
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+{{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
+{{% endif %}}

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/bash/shared.sh

@@ -1,5 +1,7 @@
 # platform = multi_platform_all
 
-
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+{{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
+{{% endif %}}
 {{{ bash_dconf_settings("org/gnome/login-screen", "disable-restart-buttons", "true", dconf_gdm_dir, "00-security-settings", rule_id=rule_id) }}}
 {{{ bash_dconf_lock("org/gnome/login-screen", "disable-restart-buttons", dconf_gdm_dir, "00-security-settings-lock") }}}

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/tests/correct_value.pass.sh

@@ -6,6 +6,7 @@
 install_dconf_and_gdm_if_needed
 
 clean_dconf_settings
+add_dconf_profiles
 add_dconf_setting "org/gnome/login-screen" "disable-restart-buttons" "true" "{{{ dconf_gdm_dir }}}" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "disable-restart-buttons" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock"
 

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/tests/correct_value_wrong_db.fail.sh

@@ -6,6 +6,7 @@
 install_dconf_and_gdm_if_needed
 
 clean_dconf_settings
+add_dconf_profiles
 add_dconf_setting "org/gnome/login-screen" "disable-restart-buttons" "true" "dummy.d" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "disable-restart-buttons" "dummy.d" "00-security-settings-lock"
 

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/tests/wrong_value.fail.sh

@@ -6,6 +6,7 @@
 install_dconf_and_gdm_if_needed
 
 clean_dconf_settings
+add_dconf_profiles
 add_dconf_setting "org/gnome/login-screen" "disable-restart-buttons" "false" "{{{ dconf_gdm_dir }}}" "00-security-settings"
 add_dconf_lock "org/gnome/login-screen" "disable-restart-buttons" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock"
 

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/ansible/shared.yml

@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle
 # reboot = false
 # strategy = unknown
 # complexity = low
@@ -23,7 +23,7 @@
     mode: 0644
   register: result_lineinfile
 
-{{% if product in ['sle15', 'sle16'] %}}
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
 {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
 {{% endif %}}
 

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/bash/shared.sh

@@ -5,7 +5,7 @@
 {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
 {{% endif %}}
 
-{{% if product in ['sle15', 'sle16'] %}}
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
 {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
 {{% endif %}}
 

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/tests/missing_profiles.fail.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_ubuntu
+# platform = multi_platform_opensuse,multi_platform_ubuntu
 # packages = dconf,gdm
 
 . $SHARED/dconf_test_functions.sh

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_lock_screen_on_smartcard_removal/rule.yml

@@ -55,4 +55,8 @@ template:
         parameter: removal-action
         value: "'lock-screen'"
         section: "org/gnome/settings-daemon/peripherals/smartcard"
+        {{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+        path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/
+        {{% else %}}
         path: /etc/dconf/db/local.d/
+        {{% endif %}}

linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_lock_screen_on_smartcard_removal/tests/wrong_value.fail.sh

@@ -4,8 +4,13 @@
 . $SHARED/dconf_test_functions.sh
 
 clean_dconf_settings
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
+add_dconf_setting "org/gnome/settings-daemon/peripherals/smartcard" "removal-action" "'none'" "{{{ dconf_gdm_dir }}}" "00-security-settings"
+add_dconf_lock "org/gnome/settings-daemon/peripherals/smartcard" "removal-action" "{{{ dconf_gdm_dir }}}" "00-security-settings-lock"
+{{% else %}}
 # this test is required because the removal-action parameter requires single quoted value which the templated test does not include
 add_dconf_setting "org/gnome/settings-daemon/peripherals/smartcard" "removal-action" "'none'" "local.d" "00-security-settings"
 add_dconf_lock "org/gnome/settings-daemon/peripherals/smartcard" "removal-action" "local.d" "00-security-settings-lock"
+{{% endif %}}
 
 dconf update

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_automatic_login/ansible/shared.yml

@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel
 # reboot = false
 # strategy = unknown
 # complexity = low

linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/ansible/shared.yml

@@ -1,12 +1,12 @@
-# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_sle
 # reboot = false
 # strategy = unknown
 # complexity = low
 # disruption = medium
 - name: "Disable GNOME3 Automounting - automount-open"
   community.general.ini_file:
     mode: 0644
-{{% if product in ['sle15', 'sle16'] %}}
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
     dest: /etc/dconf/db/{{{ dconf_gdm_dir }}}/00-security-settings
 {{% else %}}
     dest: /etc/dconf/db/local.d/00-security-settings
@@ -21,7 +21,7 @@
 - name: "Prevent user modification of GNOME3 Automounting - automount-open"
   ansible.builtin.lineinfile:
     mode: 0644
-{{% if product in ['sle15', 'sle16'] %}}
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
     path: /etc/dconf/db/{{{ dconf_gdm_dir }}}/locks/00-security-settings-lock
 {{% else %}}
     path: /etc/dconf/db/local.d/locks/00-security-settings-lock
@@ -31,7 +31,7 @@
     create: yes
   register: result_lineinfile
 
-{{% if product in ['sle15', 'sle16'] %}}
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
 {{{ ansible_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
 {{% endif %}}
 

linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/bash/shared.sh

@@ -6,7 +6,7 @@
 {{% endif %}}
 
 # apply fix for enable_dconf_user_profile, OVAL checks it
-{{% if product in ['sle15', 'sle16'] %}}
+{{% if product in ['opensuse16', 'sle15', 'sle16'] %}}
 {{{ bash_enable_dconf_user_profile(profile="gdm", database="gdm") }}}
 {{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount-open", "false", dconf_gdm_dir , "00-security-settings", rule_id=rule_id) }}}
 {{{ bash_dconf_lock("org/gnome/desktop/media-handling", "automount-open", dconf_gdm_dir, "00-security-settings-lock") }}}