mediumservicesunverifiedrollback-safe

Ensure GDM session lock is enabled when screensaver is activated

gdm-lock-enabled · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, the session must be locked when the screensaver is activated to prevent unauthorized access.

Rationale

When a screensaver activates without enabling session lock, the session remains accessible to anyone who wakes the display. Requiring lock-enabled ensures that screensaver activation triggers a session lock requiring re-authentication.

Check → Remediate

Checkcommand

# Check if lock-enabled is set to true in dconf policy
if grep -qr "^lock-enabled=true" /etc/dconf/db/local.d/ 2>/dev/null; then
  echo "OK: GDM session lock is enabled on screensaver activation"
  exit 0
fi
echo "FAIL: GDM session lock on screensaver activation is not configured"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/screensaver
key:: lock-enabled
value:: true
file:: 00-screensaver

Framework references

STIG

V-258025 / RHEL-09-271075

NIST 800-53

AC-11

#gdm#gnome#screen-lock#screensaver#security