id: gdm-login-banner-configured-check

info:
  name: Ensure GDM Login Banner is Configured
  author: Th3l0newolf
  severity: low
  description: |
    This template checks whether the GDM login banner is enabled and configured.
  remediation: |
    Enable the GDM login banner and configure an appropriate warning message
    according to your organization's security policy.
  reference:
    - https://www.cisecurity.org/benchmark/ubuntu_linux
  tags: cis,linux,ubuntu,gdm,banner,audit
  metadata:
    verified: true

self-contained: true

code:
  - engine:
      - bash
    args:
      - "-c"
      - |
        enabled=$(gsettings get org.gnome.login-screen banner-message-enable 2>/dev/null)
        banner=$(gsettings get org.gnome.login-screen banner-message-text 2>/dev/null)

        if [ "$enabled" = "true" ] && [ -n "$banner" ] && [ "$banner" != "''" ]; then
          echo "[gdm-login-banner-configured-check:Policy-Pass] [GDM login banner is enabled and configured] [CIS_PASS] [low]"
        else
          echo "[gdm-login-banner-configured-check:Policy-Fail] [GDM login banner is not enabled or not configured] [CIS_FAIL] [low]"
        fi

    matchers:
      - type: word
        name: policy-pass
        words:
          - "Policy-Pass"

      - type: word
        name: policy-fail
        words:
          - "Policy-Fail"
# digest: 4a0a00473045022100e8489d5b348200a612586fc5e0fe4174623f220b4c1c44d330368d924251f574022057569da8e66eea1e3917a3111c07a2b48f45e4fbd94e6a20d27b35e1b5c732c4:922c64590222798bb761d5b6d8e72950