ComplianceAsCode / ComplianceAsCode/content
Dconf and select PAM rules freeze system during remediation
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
When implementing a new Fedora profile in #10506, I originally included multiple dconf and pam rules, however during testing I noticed that during remediation using both oscap and scap-workbench, as well as just generating a shell remediation script and executing them, the whole GUI of the system would freeze. This happened consistently both in VM and on a fresh system with 16GB of RAM, and even when left running for over an hour, nothing would happen once the remediation reached these rules:
dconf_gnome_disable_user_list
dconf_gnome_screensaver_idle_delay
dconf_gnome_screensaver_lock_delay
dconf_gnome_screensaver_lock_enabled
dconf_gnome_screensaver_user_locks
dconf_gnome_session_idle_user_locks
accounts_password_pam_pwhistory_remember_password_auth
accounts_password_pam_pwhistory_remember_system_auth
accounts_password_pam_faillock_deny
accounts_password_pam_faillock_dir
(during execution of the bash remediations of the pam rules, “Current configuration is valid.” is written to terminal before the GUI freezes.)
The one exception was rule accounts_password_pam_faillock_unlock_time, which only froze the GUI for a couple of seconds, and then the system became responsive again.
It seems that apart from the GUI freezing, the system itself does not freeze. After killing power to the system and then running a scan, the remediations finished successfully.
#### SCAP Security Guide Version:
latest master, OpenSCAP 1.3.7
#### Operating System Version:
Fedora 37 VM with 4GB RAM, Fedora 38 fresh install on laptop with 16GB RAM
#### Steps to Reproduce:
1. Use commit 9e399f5 of branch in PR #10506
2. Build the fedora product
3. Try to scan and remediate a fresh fedora system using oscap/workbench with the cusp_fedora profile
#### Actual Results:
When remediation reaches any of the above mentioned rules, GUI freezes and system is unresponsive.
#### Expected Results:
Remediation finishes without GUI freezing.
#### Additional Information/Debugging Steps:
Contributor guide
Assessment
This issue has not been assessed yet.