The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:44
# The system must require users to re-authenticate to unlock a graphical desktop environment.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
# - textfilecontent54_object (textfilecontent54_test) -- Each user's .xscreensaver must have a lock field set to true.: no extractor for field "subexpression"
# - textfilecontent54_object (textfilecontent54_test) -- Each user's .xscreensaver must have a lockTimeout of 5 seconds.: no extractor for field "subexpression"
# - textfilecontent54_object (textfilecontent54_test) -- Each user's .xscreensaver must have a timeout of 15 minutes.: no extractor for field "subexpression"
# Check to see if CDM is being run by the system.
# smf_object (smf_test)
test_1() {
(svcs -H -o state 'svc://localhost/application/graphical-login/gdm:default') | grep -qxF 'ONLINE'
}
# Check to see if XDM is being run by the system.
# smf_object (smf_test)
test_2() {
(svcs -H -o state 'svc://localhost/application/graphical-login/xdm:default') | grep -qxF 'ONLINE'
}
# XScreenSaver must have a timeout of 15 minutes.
# textfilecontent54_object (textfilecontent54_test)
test_3() {
(sed -En 's/^\s*\*timeout:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -Pq '(?:0:15:00|0:1[0-4]:[0-5][0-9]|0:0[0-9]:[0-5][0-9])'
}
# XScreenSaver must have a lockTimeout of 0:00:05.
# textfilecontent54_object (textfilecontent54_test)
test_4() {
(sed -En 's/^\s*\*lockTimeout:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -Pq '0:00:0[0-5]'
}
# XScreenSaver must have a lock field set to true.
# textfilecontent54_object (textfilecontent54_test)
test_5() {
(sed -En 's/^\s*\*lock:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -qxF 'True'
}
if ( test_1 || test_2 || ( test_3 && test_4 && test_5 ) ); then
echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
echo "FAIL (or see MANUAL REVIEW note above)"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# oval:mil.disa.stig.solaris11:def:44
if [ -f /usr/sbin/svcs ]; then
gdm_running=$(/usr/sbin/svcs -x | grep "svc://localhost/application/graphical-login/gdm:default" | grep ONLINE | wc -l)
xdm_running=$(/usr/sbin/svcs -x | grep "svc://localhost/application/graphical-login/xdm:default" | grep ONLINE | wc -l)
if [ $gdm_running -gt 0 ] || [ $xdm_running -gt 0 ]; then
if [ ! -f /usr/share/X11/app-defaults/XScreenSaver ]; then
echo "FAIL"
exit 1
fi
if ! grep -q '^\\s*\\*timeout:\\s*0:15:00\\s*$' /usr/share/X11/app-defaults/XScreenSaver && ! grep -q '^\\s*\\*lockTimeout:\\s*0:00:05\\s*$' /usr/share/X11/app-defaults/XScreenSaver && ! grep -q '^\\s*\\*lock:\\s*True\\s*$' /usr/share/X11/app-defaults/XScreenSaver; then
echo "FAIL"
exit 1
fi
for user in $(getent passwd | cut -d: -f1); do
if [ ! -f "$HOME/$user/.xscreensaver" ]; then
echo "FAIL"
exit 1
fi
if ! grep -q '^timeout: 0:15:00' "$HOME/$user/.xscreensaver" || ! grep -q '^lockTimeout: 0:00:05' "$HOME/$user/.xscreensaver" || ! grep -q '^lock: True' "$HOME/$user/.xscreensaver"; then
echo "FAIL"
exit 1
fi
done
echo "PASS"
exit 0
fi
fi
echo "FAIL"
exit 1