mediumsystemunverifiedrollback-safe

Prevent users from overriding the session idle-delay setting

gdm-idle-delay-override · RHEL ≥ 8 · 1 impl

Description

RHEL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface. The idle-delay setting must be locked in the dconf system database.

Rationale

Allowing users to override the idle-delay setting lets them prevent the automatic screen lock from activating. Locking this setting ensures all graphical sessions have the required inactivity timeout.

Check → Remediate

Checkcommand

if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi
grep -rq '/org/gnome/desktop/session/idle-delay' \
  /etc/dconf/db/local.d/locks/ 2>/dev/null

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/session
key:: idle-delay
value:: 900
value_type:: uint32
file:: 00-screensaver
lock:: true

Framework references

STIG

V-281279 / RHEL-10-700760V-258024 / RHEL-09-271070V-244538

NIST 800-53

AC-11CM-6

#gdm#graphical#dconf#idle-delay#stig