documentation_complete: true

prodtype: rhel7,fedora

title: 'Disable WIFI Network Connection Creation in GNOME3'

description: |-
    <tt>GNOME</tt> allows users to create ad-hoc wireless connections through the
    <tt>NetworkManager</tt> applet. Wireless connections should be disabled by
    adding or setting <tt>disable-wifi-create</tt> to <tt>true</tt> in
    <tt>/etc/dconf/db/local.d/00-security-settings</tt>. For example:
    <pre>[org/gnome/nm-applet]
    disable-wifi-create=true
    </pre>
    Once the settings have been added, add a lock to
    <tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
    For example:
    <pre>/org/gnome/nm-applet/disable-wifi-create</pre>
    After the settings have been set, run <tt>dconf update</tt>.

rationale: |-
    Wireless network connections should not be allowed to be configured by general
    users on a given system as it could open the system to backdoor attacks.

severity: medium

identifiers:
    cce@rhel7: 80118-3

references:
    cui: 3.1.16

ocil_clause: 'WIFI connections can be created through GNOME'

ocil: |-
    To ensure that WIFI connections caanot be created, run the following command:
    <pre>$ gsettings get org.gnome.nm-applet disable-wifi-create</pre>
    If properly configured, the output should be <tt>true</tt>.
    To ensure that users cannot enable WIFI connection creation, run the following:
    <pre>$ grep wifi-create /etc/dconf/db/local.d/locks/*</pre>
    If properly configured, the output should be
    <tt>/org/gnome/nm-applet/disable-wifi-create</tt>
