← Rules Catalog
mediumservicesunverifiedrollback-safe

Ensure GDM disable-restart-buttons setting cannot be overridden

gdm-disable-restart-buttons-override · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, users must not be able to override the disable-restart-buttons setting for the graphical user interface login screen.

Rationale

Without locking the disable-restart-buttons setting, a local user could re-enable power control buttons on the login screen, allowing unauthorized system restarts that could be used to boot alternate media and bypass security controls.

Check → Remediate

Checkcommand
# Check if disable-restart-buttons is locked
found=0
for lockdir in /etc/dconf/db/gdm.d/locks /etc/dconf/db/local.d/locks; do
  if [ -d "$lockdir" ]; then
    for lockfile in "$lockdir"/*; do
      if [ -f "$lockfile" ] && grep -q "/org/gnome/login-screen/disable-restart-buttons" "$lockfile" 2>/dev/null; then
        found=1
        break 2
      fi
    done
  fi
done
if [ "$found" -eq 1 ]; then
  echo "OK: GDM disable-restart-buttons setting is locked"
  exit 0
fi
echo "FAIL: GDM disable-restart-buttons setting can be overridden"
exit 1
expected_exit:
0
Remediatedconf_set
schema:
org/gnome/login-screen
key:
disable-restart-buttons
value:
true
file:
00-security-settings
db:
gdm
lock:
true

Framework references

STIG

V-281284 / RHEL-10-700810V-258030 / RHEL-09-271100

NIST 800-53

CM-6AC-6
#gdm#gnome#login-screen#restart#security