mediumservicesunverifiedrollback-safe

Ensure GDM disables restart and power-off buttons on login screen

gdm-disable-restart-buttons · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, the ability to restart the system from the GDM login screen must be disabled.

Rationale

Allowing a user to restart or shut down the system from the login screen without authentication could be used to disrupt availability or to boot into alternate media to bypass access controls.

Check → Remediate

Checkcommand

# Check if disable-restart-buttons=true in gdm dconf config
if grep -qr "^disable-restart-buttons=true" /etc/dconf/db/gdm.d/ 2>/dev/null || \
   grep -qr "^disable-restart-buttons=true" /etc/dconf/db/local.d/ 2>/dev/null; then
  echo "OK: GDM restart buttons are disabled on login screen"
  exit 0
fi
echo "FAIL: GDM restart buttons are not disabled on login screen"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/login-screen
key:: disable-restart-buttons
value:: true
file:: 00-security-settings
db:: gdm

Framework references

STIG

V-258029 / RHEL-09-271095

NIST 800-53

CM-6AC-6

#gdm#gnome#login-screen#restart#security