Skip to content

Commit b12ab8e

Browse files
tstrombergtstromberg
committed
more mate fixes
1 parent c62a3ef commit b12ab8e

File tree

3 files changed

+63
-52
lines changed

3 files changed

+63
-52
lines changed

‎cmd/agent/checks.yaml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -235,13 +235,13 @@ checks:
235235
excludes: "xautolock|xss-lock|light-locker"
236236
remediation:
237237
- Configure screen locking for Openbox
238-
- "Add to ~/.config/openbox/autostart: 'xautolock -time 15 -locker \"i3lock -c 000000\" &'"
238+
- 'Add to ~/.config/openbox/autostart: ''xautolock -time 15 -locker "i3lock -c 000000" &'''
239239
# Sway (Wayland) - Only check if sway is running
240240
- output: pgrep sway >/dev/null && grep "exec swayidle" ~/.config/sway/config 2>/dev/null
241241
excludes: "swayidle"
242242
remediation:
243243
- Configure swayidle to lock screen automatically
244-
- "Add to Sway config: 'exec swayidle -w timeout 900 \"swaylock -f\" before-sleep \"swaylock -f\"'"
244+
- 'Add to Sway config: ''exec swayidle -w timeout 900 "swaylock -f" before-sleep "swaylock -f"'''
245245
# Generic X11 fallback - Only if X11 is running but no specific DE detected
246246
- output: >
247247
pgrep Xorg >/dev/null && ! (pgrep gnome-shell >/dev/null || pgrep mate-session >/dev/null || pgrep xfce4-session >/dev/null ||
@@ -251,7 +251,7 @@ checks:
251251
remediation:
252252
- Configure X11 screen saver with 'xset s 900'
253253
- Install and configure a screen locker (xlock, i3lock, slock)
254-
- "Add to window manager startup: 'xautolock -time 15 -locker \"xlock\" &'"
254+
- 'Add to window manager startup: ''xautolock -time 15 -locker "xlock" &'''
255255
linux:
256256
# Linux-specific additional checks
257257
windows:
@@ -277,43 +277,43 @@ checks:
277277
- Set "Turn display off on power adapter when inactive" to 15 minutes or less
278278
unix:
279279
# GNOME - Only check timeout if GNOME Shell is running
280-
- output: pgrep gnome-shell && gsettings get org.gnome.desktop.session idle-delay
280+
- output: pgrep gnome-shell >/dev/null && gsettings get org.gnome.desktop.session idle-delay
281281
includes: "^(0|9[1-9][0-9]|[1-9][0-9]{3,})$"
282282
remediation:
283283
- Set GNOME screensaver timeout to 15 minutes or less
284284
- Run 'gsettings set org.gnome.desktop.session idle-delay 900'
285285
# MATE - Only check timeout if MATE session is running
286-
- output: pgrep mate-session && gsettings get org.mate.screensaver lock-delay
286+
- output: pgrep mate-session >/dev/null && gsettings get org.mate.session idle-delay
287287
includes: "^(0|1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})$"
288288
remediation:
289289
- Set MATE screensaver timeout to 15 minutes or less
290-
- Run 'gsettings set org.mate.screensaver lock-delay 15'
290+
- Run 'gsettings set org.mate.session idle-delay 15'
291291
# XFCE - Only check timeout if XFCE session is running
292-
- output: pgrep xfce4-session && xfconf-query -c xfce4-power-manager -p /xfce4-power-manager/dpms-on-ac-sleep
292+
- output: pgrep xfce4-session >/dev/null && xfconf-query -c xfce4-power-manager -p /xfce4-power-manager/dpms-on-ac-sleep
293293
includes: "^(0|1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})$"
294294
remediation:
295295
- Set XFCE display timeout to 15 minutes or less
296296
- Run 'xfconf-query -c xfce4-power-manager -p /xfce4-power-manager/dpms-on-ac-sleep -s 15'
297-
- output: pgrep xfce4-session && xfconf-query -c xfce4-power-manager -p /xfce4-power-manager/dpms-on-battery-sleep
297+
- output: pgrep xfce4-session >/dev/null && xfconf-query -c xfce4-power-manager -p /xfce4-power-manager/dpms-on-battery-sleep
298298
includes: "^(0|1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})$"
299299
remediation:
300300
- Set XFCE battery display timeout to 15 minutes or less
301301
- Run 'xfconf-query -c xfce4-power-manager -p /xfce4-power-manager/dpms-on-battery-sleep -s 15'
302302
# KDE Plasma - Only check timeout if KDE session is running
303-
- output: pgrep plasmashell && kreadconfig5 --file kscreenlockerrc --group Daemon --key Timeout
303+
- output: pgrep plasmashell >/dev/null && kreadconfig5 --file kscreenlockerrc --group Daemon --key Timeout
304304
includes: "^(0|1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})$"
305305
remediation:
306306
- Set KDE screen lock timeout to 15 minutes or less
307307
- Run 'kwriteconfig5 --file kscreenlockerrc --group Daemon --key Timeout 15'
308308
- Or configure in System Settings > Desktop Behavior > Screen Locking
309309
# Cinnamon - Only check timeout if Cinnamon is running
310-
- output: pgrep cinnamon && gsettings get org.cinnamon.desktop.screensaver lock-delay
310+
- output: pgrep cinnamon >/dev/null && gsettings get org.cinnamon.desktop.screensaver lock-delay
311311
includes: "^(0|9[1-9][0-9]|[1-9][0-9]{3,})$"
312312
remediation:
313313
- Set Cinnamon screensaver timeout to 15 minutes or less
314314
- Run 'gsettings set org.cinnamon.desktop.screensaver lock-delay 900'
315315
# Budgie - Only check timeout if Budgie is running
316-
- output: pgrep budgie-panel && gsettings get org.gnome.desktop.session idle-delay
316+
- output: pgrep budgie-panel >/dev/null && gsettings get org.gnome.desktop.session idle-delay
317317
includes: "^(0|9[1-9][0-9]|[1-9][0-9]{3,})$"
318318
remediation:
319319
- Set Budgie screensaver timeout to 15 minutes or less
@@ -329,30 +329,30 @@ checks:
329329
includes: "-time (1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})"
330330
remediation:
331331
- Configure xautolock with 15 minute timeout or less
332-
- "Add to autostart: 'xautolock -time 15 -locker \"light-locker\" &'"
332+
- 'Add to autostart: ''xautolock -time 15 -locker "light-locker" &'''
333333
# Sway - Only check timeout if sway is running
334334
- output: pgrep sway >/dev/null && grep "timeout" ~/.config/sway/config 2>/dev/null
335335
includes: "timeout [9][1-9][0-9][0-9]|timeout [1-9][0-9]{4,}"
336336
remediation:
337337
- Configure swayidle timeout to 15 minutes (900 seconds) or less
338-
- "Add to Sway config: 'exec swayidle -w timeout 900 \"swaylock -f\"'"
338+
- 'Add to Sway config: ''exec swayidle -w timeout 900 "swaylock -f"'''
339339
# i3 Window Manager - Check if xautolock is running with proper timeout
340340
- output: pgrep i3 >/dev/null && pgrep -fl "xautolock.*-time"
341341
includes: "-time (1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})"
342342
remediation:
343343
- Configure xautolock timeout to 15 minutes or less
344-
- "Add to i3 config: 'exec --no-startup-id xautolock -time 15 -locker \"i3lock -c 000000\"'"
344+
- 'Add to i3 config: ''exec --no-startup-id xautolock -time 15 -locker "i3lock -c 000000"'''
345345
# Openbox - Check if xautolock is running with proper timeout
346346
- output: pgrep openbox >/dev/null && pgrep -fl "xautolock.*-time"
347347
includes: "-time (1[6-9]|[2-9][0-9]|[1-9][0-9]{2,})"
348348
remediation:
349349
- Configure xautolock timeout to 15 minutes or less
350-
- "Add to ~/.config/openbox/autostart: 'xautolock -time 15 -locker \"i3lock -c 000000\" &'"
350+
- 'Add to ~/.config/openbox/autostart: ''xautolock -time 15 -locker "i3lock -c 000000" &'''
351351
# Generic X11 - Only if X11 is running but no specific DE detected
352352
- output: >
353-
pgrep Xorg && ! (pgrep gnome-shell || pgrep mate-session || pgrep xfce4-session ||
354-
pgrep plasmashell || pgrep cinnamon || pgrep budgie-panel || pgrep lxqt-session ||
355-
pgrep lxsession || pgrep i3 || pgrep openbox || pgrep sway) && xset q
353+
pgrep Xorg >/dev/null && ! (pgrep gnome-shell >/dev/null || pgrep mate-session >/dev/null || pgrep xfce4-session >/dev/null ||
354+
pgrep plasmashell >/dev/null || pgrep cinnamon >/dev/null || pgrep budgie-panel >/dev/null || pgrep lxqt-session >/dev/null ||
355+
pgrep lxsession >/dev/null || pgrep i3 >/dev/null || pgrep openbox >/dev/null || pgrep sway >/dev/null) && xset q
356356
includes: "timeout:.*([9][1-9][0-9]|[1-9][0-9]{3,})"
357357
remediation:
358358
- Set X11 screen saver timeout to 15 minutes (900 seconds) or less

‎cmd/agent/main.go‎

Lines changed: 38 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -997,6 +997,41 @@ func (a *Agent) displayCheckResults(results map[string]CheckResult, finalOrder [
997997
printLine("")
998998
}
999999

1000+
// displayFailedOutput displays a single failed output with appropriate formatting.
1001+
func displayFailedOutput(idx int, output gitmdm.CommandOutput, totalOutputs int) {
1002+
// If multiple commands were checked, number them
1003+
if totalOutputs > 1 {
1004+
printLine(" [Command %d of %d - FAILED]", idx+1, totalOutputs)
1005+
}
1006+
1007+
// Show command or file that was checked
1008+
if output.Command != "" {
1009+
printLine(" Command: %s", output.Command)
1010+
} else if output.File != "" {
1011+
printLine(" File: %s", output.File)
1012+
}
1013+
// Show why it failed
1014+
if output.FailReason != "" {
1015+
printLine(" Failure: %s", output.FailReason)
1016+
}
1017+
1018+
// Show relevant output (truncated for readability)
1019+
if output.Stdout != "" {
1020+
lines := strings.Split(output.Stdout, "\n")
1021+
maxLines := maxDisplayLines
1022+
if len(lines) > maxLines {
1023+
printLine(" Output: %s", strings.Join(lines[:maxLines], "\n "))
1024+
printLine(" ... (output truncated, %d more lines)", len(lines)-maxLines)
1025+
} else {
1026+
printLine(" Output: %s", strings.ReplaceAll(output.Stdout, "\n", "\n "))
1027+
}
1028+
}
1029+
1030+
if output.Stderr != "" && output.Stderr != output.FailReason {
1031+
printLine(" Error: %s", output.Stderr)
1032+
}
1033+
}
1034+
10001035
// displayFailedChecks shows details for all failed checks.
10011036
func (*Agent) displayFailedChecks(results map[string]CheckResult, finalOrder []string) {
10021037
// Get failed checks in order
@@ -1018,48 +1053,17 @@ func (*Agent) displayFailedChecks(results map[string]CheckResult, finalOrder []s
10181053
if len(result.Outputs) > 0 {
10191054
printLine(" 💻 Evidence:")
10201055
failedCount := 0
1021-
for i, output := range result.Outputs {
1056+
for idx, output := range result.Outputs {
10221057
// Skip outputs that didn't fail
10231058
if !output.Failed {
10241059
continue
10251060
}
10261061
failedCount++
10271062

1028-
// If multiple commands were checked, number them
1029-
if len(result.Outputs) > 1 {
1030-
printLine(" [Command %d of %d - FAILED]", i+1, len(result.Outputs))
1031-
}
1032-
1033-
// Show command or file that was checked
1034-
if output.Command != "" {
1035-
printLine(" Command: %s", output.Command)
1036-
} else if output.File != "" {
1037-
printLine(" File: %s", output.File)
1038-
}
1039-
// Show why it failed
1040-
if output.FailReason != "" {
1041-
printLine(" Failure: %s", output.FailReason)
1042-
}
1043-
1044-
// Show relevant output (truncated for readability)
1045-
if output.Stdout != "" {
1046-
lines := strings.Split(output.Stdout, "\n")
1047-
maxLines := maxDisplayLines
1048-
if len(lines) > maxLines {
1049-
printLine(" Output: %s", strings.Join(lines[:maxLines], "\n "))
1050-
printLine(" ... (output truncated, %d more lines)", len(lines)-maxLines)
1051-
} else {
1052-
printLine(" Output: %s", strings.ReplaceAll(output.Stdout, "\n", "\n "))
1053-
}
1054-
}
1055-
1056-
if output.Stderr != "" && output.Stderr != output.FailReason {
1057-
printLine(" Error: %s", output.Stderr)
1058-
}
1059-
1063+
displayFailedOutput(idx, output, len(result.Outputs))
10601064
// Add spacing between multiple failed commands
10611065
if failedCount < len(result.Outputs) && len(result.Outputs) > 1 {
1062-
for j := i + 1; j < len(result.Outputs); j++ {
1066+
for j := idx + 1; j < len(result.Outputs); j++ {
10631067
if result.Outputs[j].Failed {
10641068
printLine("")
10651069
break

‎internal/analyzer/analyzer.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,14 @@ import (
55
"fmt"
66
"gitmdm/internal/config"
77
"gitmdm/internal/gitmdm"
8+
"log"
9+
"os"
810
"regexp"
911
"strings"
1012
)
1113

14+
var debug = os.Getenv("DEBUG") == "true"
15+
1216
// AnalyzeCheck analyzes a CommandOutput against a CommandRule to determine pass/fail.
1317
func AnalyzeCheck(output *gitmdm.CommandOutput, rule config.CommandRule) error {
1418
// If command/file was skipped or missing, don't fail the check
@@ -20,6 +24,9 @@ func AnalyzeCheck(output *gitmdm.CommandOutput, rule config.CommandRule) error {
2024
// skip includes/excludes analysis (the command couldn't run properly)
2125
if output.ExitCode != 0 && rule.ExitCode == nil {
2226
// Mark as skipped since the command couldn't run (e.g., pgrep failed)
27+
if debug {
28+
log.Printf("[DEBUG] Skipping analysis for command with exit code %d (no exitcode rule configured)", output.ExitCode)
29+
}
2330
output.Skipped = true
2431
return nil
2532
}

0 commit comments

Comments
 (0)