The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.ol9os:def:271860
# OL 9 must configure a DNS processing mode set be Network Manager.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# DNS setting exists in NetworkManager.conf and is default or none
# textfilecontent54_object (textfilecontent54_test)
test_1() {
( (sed -En 's/^dns=(\S*)\s*$/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -qxF 'none' ) || ( (sed -En 's/^dns=(\S*)\s*$/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -qxF 'default' ) || ( (sed -En 's/^dns=(\S*)\s*$/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -qxF 'systemd-resolved' )
}
# DNS setting exists in NetworkManager.conf main section
# textfilecontent54_object (textfilecontent54_test)
test_2() {
(sed -En 's/^\[main\]((?:\r?\n(?:[^[\r\n].*)?)*)/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -Pq '\ndns='
}
if ( test_1 && test_2 ); then
echo "PASS"
else
echo "FAIL"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.ol9os:def:271860
if [ ! -f "/etc/NetworkManager/NetworkManager.conf" ]; then
echo "FAIL"
exit 1
fi
if grep -qE "^dns=(none|default|systemd-resolved)\s*$" /etc/NetworkManager/NetworkManager.conf; then
if grep -qE "^\\[main\\]" /etc/NetworkManager/NetworkManager.conf; then
echo "PASS"
exit 0
fi
fi
echo "FAIL"
exit 1