mediumsystemunverifiedrollback-safe
Configure and lock graphical session lock-delay setting
gdm-lock-delay · RHEL ≥ 8 · 1 impl
Description
RHEL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface. The lock-delay dconf setting must be configured and locked in the system database.
Rationale
Allowing users to override the session lock-delay setting could allow a user to prevent the automatic screen lock from activating. Locking this setting via dconf ensures all users have the required idle lock behavior regardless of individual preferences.
Check → Remediate
Checkcommand
if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi grep -rq 'lock-delay' /etc/dconf/db/local.d/locks/ 2>/dev/null || grep -rq '/org/gnome/desktop/screensaver/lock-delay' /etc/dconf/db/local.d/locks/ 2>/dev/null
- expected_exit:
- 0
Remediatedconf_set
- schema:
- org/gnome/desktop/screensaver
- key:
- lock-delay
- value:
- 5
- value_type:
- uint32
- file:
- 00-screensaver
- lock:
- true
Framework references
STIG
V-281281 / RHEL-10-700780V-258026 / RHEL-09-271080V-230354
NIST 800-53
AC-11CM-6
#gdm#graphical#lock-delay#dconf#stig